diff --git a/src/controllers/settings_controller.rs b/src/controllers/settings_controller.rs
index 393ed72..ddf2286 100644
--- a/src/controllers/settings_controller.rs
+++ b/src/controllers/settings_controller.rs
@@ -215,6 +215,8 @@ pub fn get_data_conservation_policy(r: &mut HttpRequestHandler) -> RequestResult
 
 /// Set data conservation policy
 pub fn set_data_conservation_policy(r: &mut HttpRequestHandler) -> RequestResult {
+    r.need_user_password("password")?;
+
     let policy = NewDataConservationPolicy {
         user_id: r.user_id()?,
         delete_account_after: r.post_positive_u64_opt("inactive_account_lifetime")?,