Respect your privacy: An identifiable and authorized privacy-preserving data retrieval protocol through decentralized identifier

The General Data Protection Regulation (GDPR) requires personal data processing to satisfy both the principles of lawfulness and data minimization. However, existing privacy-preserving data retrieval protocols rarely meet both principles, especially at the batch scale. To solve these problems, we present IAPDR, an I dentifiable and A uthorized P rivacy-Preserving D ata R etrieval protocol that builds on Decentralised Identifier (DID) that focuses on data-subject privacy under GDPR compliance. IAPDR uses DIDs to provide verifiable, globally unique identities while preserving anonymity and self-sovereign management. It uses non-interactive zero-knowledge proofs (NIZKs) for anonymous authorization. The data controller can verify the lawfulness of each retrieval request without learning any personally identifiable data, thereby upholding data minimization. For scalable retrieval, IAPDR employs Private Set Intersection with Payload (PSI-Payload) to execute large-batch matching while keeping both identifiers and associated records confidential. We prove anonymity and unforgeability, and give a Universal Composability (UC) security analysis in the semi-honest model. Under the same dataset sizes and network settings on public benchmarks, IAPDR achieves an average 1.36 × improvement in computational efficiency and an average 3.62 × reduction in total communication compared with state-of-the-art schemes. These enhancements make GDPR compliant privacy-preserving data retrieval practically feasible.