Recital 64
Recital 64 of the GDPR, as in force since 25 May 2018. Its key is gdpr-recitals:rec-64.
The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.