How to answer GDPR requests when part of the information is accessible?
<p>Lets say a company stores information in Catagory 1 , 2 , 3 .Catagory 1 in formation is assciated with email , Cata gory 2 with user name and catagory 3 with phone number.A user sends a request via email and writes &quot;give (the user) a copy of the data.&quot; Does the company send only catagory 1 data or ask for more information and send more data for catagory 2 and 3?</p>

<p>Interpreting <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Art. 15 GDPR</a> &quot;Right of access by the data subject&quot; I would think that
the company in your scenario has to send all data which they have collected about the user, after the user is identified by e.g. email address. Plus other information like e.g. the purposes of the processing, see all bullet points in the link.</p>
<p>If you have user data associated with a user-name and other data associated with a phone-number, how can you find out that this is the same user? In your scenario the best way would be to state in the privacy policy, that the user has to provide username plus full name plus phone-number in his request. Or you redesign your data collection procedure to avoid this issue. If you provide only part of the data you might need to prove why, which might require some effort.</p>
<p>Is one possible scenario you think of e.g. having a newsletter based on email addresses, and, independently a webform where one can give name and phone-number?</p>

gdpr