Access request without an existing identifier: must the controller reallocate data?

An access request does not mean that every business must first obtain a new identifier for every request. Article 11 GDPR links the obligations to whether the data subject has to be identified for the specific processing purpose. If the controller cannot allocate the person despite an appropriate assessment, the data subject rights under Articles 15 to 20 generally apply again only when additional information makes identification possible.

This is not a blanket refusal to provide information. A controller cannot rely on poor filing or an incomplete search to claim that allocation is impossible. The relevant questions are which data, means and information are actually available to the controller and which further details the requester can provide.

Article 11 GDPR applies where identifying the data subject is not or is no longer necessary for the processing purpose. In that situation, the controller is not required to retain, obtain or process additional information solely to identify a person for the mere purpose of complying with the GDPR. The rule protects a data-minimising organisation and does not require an artificial identification system.

If the controller can demonstrate that it is not in a position to identify the data subject in this situation, it must inform the data subject where possible. Articles 15 to 20 then generally do not apply unless the data subject provides additional information that enables identification. The assessment therefore cannot stop at the question whether a name is missing from one database.

The first question is whether the specific purpose requires allocation to a natural person. A system may hold measurements, technical events or statistical records without the controller needing to know the person behind them for that purpose. The situation differs where processing is based on a customer account, contract, personnel file or individual user profile and allocation is part of the purpose.

The actual organisation matters. A controller cannot lower the identification threshold through a formal label for the data. If allocation tables, contact details or other available information exist, they must be included in the assessment. The question is whether a reasonable allocation is possible with the means available, not whether a particular field is called an identifier.

The purpose assessment is separate from checking the identity of the person making the request. A business may know who is contacting it while still being unable to tell which pseudonymous records belong to that person. Conversely, a record may be allocable while the requester’s communication channel still needs to be secured.

Before responding, identify the allocation means that are actually available. Depending on the processing, these may include an account number, a separately stored allocation table, a user account, a contract, an email address, a device identifier or an internal reference. The mere existence of a technical code does not show whether the controller can connect it to a person.

Pseudonymised data remains personal data where the controller or another party can establish the link with available additional information. The Article 11 assessment therefore asks whether such information is held by the controller, may lawfully be used and is actually available for the specific purpose. A missing name in the main system is not enough if a usable allocation exists elsewhere.

If no available connection exists and identification is not required for the purpose, Article 11 does not require a later matching exercise solely because a data subject has made a request. An organisation does not have to reverse data minimisation to create new personal information. The result of this assessment should nevertheless be recorded in a traceable way.

Article 11 GDPR does not create a general duty to obtain new identifiers or merge separate records for every access request. The provision makes clear that additional information does not have to be retained, obtained or processed solely for identification and the mere purpose of complying with the Regulation where identification is not necessary for the processing purpose.

This limit does not permit deliberately created ignorance. If the data can be allocated with reasonable effort from information used in the ordinary processing, that information must be considered. A business also cannot rely only on an inadequate search routine, a department contacted too late or a fragmented filing system. Organisational disorder is not proof that identification is impossible.

A clear sequence helps in practice. First identify which information is held by the controller and can be used. Second determine which limited additional information the data subject could supply. Third record whether allocation becomes possible. The first step must not be replaced by voluntarily constructing a new identifier.

If the data subject provides additional information that makes identification possible, the Article 11 position must be reassessed. The information must be capable of creating a concrete connection to the stored data. A bare assertion that data belongs to a person does not establish the required allocation.

The follow-up should describe precisely which connection is missing. Depending on the case, it may concern a former customer account, a period, a transaction reference or a communication channel already known to the business. Keep the request limited to what is required. A blanket demand for an identity document is not automatically the right next step.

Once the additional information enables identification, the data subject rights under Articles 15 to 20 must be assessed in light of the actual request. This does not mean that every requested item must automatically be disclosed. Scope, other people’s rights, exemptions and an understandable response require separate assessment.

Article 11 GDPR requires information to the data subject where the controller has demonstrated that identification is not possible and communication is possible. The notice should explain the concrete boundary: which data was reviewed, which allocation is missing and which additional information might allow a new assessment. A formulaic response without a factual finding does not help the requester.

For a letter recognisable as a data subject request, the general arrangements in Article 12 GDPR must also be considered. Record receipt, the initial allocation assessment, each follow-up and the later response with timestamps. Internal routing should not mean that the one-month period is only considered after the request reaches the right team.

Whether a follow-up affects further handling depends on the circumstances and on which information is genuinely required for identification. Additional information must not be used as a blanket way to stop the deadline. The response should reflect a documented and proportionate assessment of receipt and the subsequent steps.

A note stating “no identifier available” is usually too short. A useful search record states the processing purpose, affected data holdings, search terms, available allocation tables and the result. It should show whether a source does not exist, is no longer available or may not be used for the purpose.

The documentation should not burden the data subject with internal technical detail. Internally, however, it should show why allocation was possible, impossible or dependent on an additional detail. If the assessment later changes, record which new circumstance caused the change.

This also helps distinguish the request from other access questions. The existing overview of identity, deadlines and data copies explains the general access-request process. Where third-party data is involved, the assessment of redactions may also be required.

Article 11 GDPR concerns whether the data subject can be identified for the processing purpose. That is different from securing the identity of the person making the current request. A secure communication channel protects against disclosure to the wrong person, but it does not by itself connect pseudonymous records to that requester.

Genuine anonymisation must also be distinguished from pseudonymisation. Anonymous data no longer relates to an identified or identifiable person, while pseudonymous data can remain personal data if available additional information preserves the link. The overview of anonymisation and pseudonymisation explains that distinction. For technical identity procedures, video identification and biometric data is a separate issue.

The response should keep these levels separate. A business may need an additional detail to allocate data without using biometric identification. Conversely, a securely verified requester cannot obtain data that the controller still cannot allocate to any person after an appropriate assessment.

Must a business create a new identifier for every request? No. Article 11 GDPR does not require additional information to be retained, obtained or processed solely for identification and mere compliance where identification is not necessary for the processing purpose.

Is a missing name in the system enough to refuse the request? No. Other available information and reasonable search routes must be considered. Poor filing or an incomplete search does not prove that identification is impossible.

What can the data subject do if allocation is missing? The data subject can provide additional information that makes identification possible. Which information is suitable depends on the available data and the processing purpose.

Does Article 11 apply only to access requests? No. Article 11 concerns identification in processing and states the effect of missing identification on the data subject rights under Articles 15 to 20.

Must an identity document always be requested? No. Additional information must be necessary and proportionate for identification. An identity document is not automatically required or suitable for every processing operation.

An access request without an existing identifier depends on the processing purpose, the allocation means actually available and the information supplied by the requester. We assess whether Article 11 GDPR applies, whether the search has been documented sufficiently and which limited additional detail could support a new assessment. Send us the request, prior communication and internal search record so that the next steps can be defined clearly.