The response to data subject requests must not only include the information you have stored about the requesting person, but also information about WHY you process the data, how long the data is stored, and information about the rights of the data subject (see Art. 15).
The information may not affect the rights and freedoms of others. This mainly protects the business secrets and data of other persons.
When a large amount of data has been processed, it is legitimate to ask the person concerned which category the information right relates to.
You have 30 days to answer the requests. If a large number of requests are received, this period can be extended to 90 days.
Affected persons can sue with a lawyer or complain to the authorities.