Handling a "subject access request" without panicking

Anyone can ask what personal data you hold about them, and UK GDPR generally gives you one calendar month to respond, so having a simple internal process for who receives it, who searches for the data, and who reviews before sending avoids a scramble. Search email, HR systems, CRM and any other place personal data might reasonably live, not just the obvious one.

Coach's tip: agree the process before the first request arrives; most businesses' first SAR is also their first time thinking about how to actually handle one.