The response to a DSAR request must include a number of fields. Many companies fulfill the requests with a template that can be automatically populated from stored data. If the company holds several records on a specific person, it is only obliged to supply the details of the requested context.
As well as the data itself, the company is obliged to provide information on how that information is held and used. Here is a list of the factors that an individual can request information about:
Personal information
Confirmation that you process their personal data
The legal basis for processing the data
The period for which you’ll store their data
Information about how the data was obtained
Information about automated decision-making and profiling
The details of the third parties with which you share their information