ABSTRACT
The basic position is that when someone makes a valid Subject Access request you have to specify:
• whether any of their personal data is being processed by you, or for you by a Data Processor.
• a description of the data, why you hold it and who it may be disclosed to.
