If you don't respond to a SAR within the 30 day time period, the person that made the request can easily make a complaint either to your business or to the Information Commissioner’s Office (ICO). Poor handling of data can of course also result in fines.