When someone requests access to their personal data, your company/organisation must:
confirm whether or not it is processing personal data concerning them;
provide a copy of the personal data it holds about them;
provide information about the processing (such as purposes, categories of personal data, recipients, etc.)