Identity Verification

Before disclosing personal data, you must be satisfied that the requester is who they claim to be. Verifying identity in SAR Portal is a single click — the Mark Verified button. When you click it, the app records that the subject was verified, when, and the method it set automatically, so you have defensible evidence under GDPR Article 12.

What Gets Recorded

When you mark a case verified, the app stores a structured record:

That identity was verified — the case status changes to Identity Verified
Verification method — set automatically (see below); you do not choose it
Timestamp — captured automatically

This record is written to the audit trail and cannot be edited after the fact, giving you a reliable compliance record.

How the Method Is Recorded

You don’t pick a verification method from a menu. SAR Portal records one of two methods:

Recorded method	When it applies
Email One-Time Password	The requester verified their email with a one-time code on your portal page. SAR Portal then records this method on their existing cases that have no method yet
Manual Review by Admin	An Admin, Case Manager or Reviewer clicked Mark Verified on a case that had no method recorded yet

Clicking Mark Verified keeps a method that was already recorded. It does not replace Email One-Time Password with Manual Review by Admin.

New portal requests start without a method

A request submitted through your public portal arrives as Opened, with no verification method recorded. The method is added the next time the requester verifies their email on your portal page, for example to check their case. Recording it does not change the case status. Until a method exists, the Close Case dialog warns you. Click Mark Verified once you are satisfied, to record the method and set the case to Identity Verified.

Because the portal matches cases by email address, the Email One-Time Password method can also be recorded on a case your team created by hand, if it holds the same email address.

No method picker or notes field

There is no dropdown to choose among email OTP, ID document, knowledge-based or other methods, and no free-text verification-notes box. Verification is one click and the method is set for you. The case notes cannot be edited on the case page either. If you carried out additional identity checks (e.g. you inspected an ID document), describe them in your Request Info message or in the Closure Notes when you close the case, or attach a record of them when you close it.

How to Verify a Case

Open the case from your Cases list
Once you’re satisfied the requester is genuine, click Mark Verified
The case status changes to Identity Verified and the record (method and timestamp) is written to the audit trail automatically

Admins, Case Managers and Reviewers can mark a case verified. The button is shown on open cases that are not already Identity Verified.

Good Practice

Satisfy yourself of the subject’s identity before clicking Mark Verified, especially for access requests containing sensitive data or requests received through unverified channels.
If you carried out a specific check (matched details against your records, inspected an ID document, asked knowledge-based questions), describe what you did in your Request Info message or the Closure Notes, so the record tells the full story alongside the auto-recorded method.
When you go to close a case, the Close Case dialog warns you if no identity verification was recorded. Treat that as a prompt to verify first unless you’re closing for a reason that doesn’t require it (e.g. the subject couldn’t be identified).

Next Steps

Case Statuses - Understand the workflow states
Case Actions - Available actions for processing
Deadlines & Extensions - Stopping the clock on UK cases while you verify identity