[sadturnip]

I am coming to the whole GDPR party really late (very recent startup).

For example we use Auth0 for our authentication service. Auth0 doesn't support storing everything. So we use the auth0 user id in a db table, which contains some user preferences.

Does that mean i need to get consent from the user to use their user id? In our database even though they are paying for this service, and we are paying for their auth0 user account?

Also if someone were to submit a GDPR request, how am i supposed to verify this person is who they claim to be?

[molf]

If you cannot operate the service without that particular data, you don’t need explicit consent.