Recognise the request
A subject access request doesn't have to use the words "subject access" or "GDPR", and it can arrive by email, letter, phone or social media. If someone asks for the information you hold about them, treat it as one.
The deadline
Reply without undue delay and at the latest within one month of receiving the request. You can extend by a further two months if the request is complex or the person has sent several - but you must tell them within the first month and explain why.
When the clock pauses
If you need proof of identity, the time limit doesn't start until you receive it - so ask promptly. If you hold a lot of information about the person and the request is unclear, you can ask them to say what they want; the clock pauses until they reply.
Searching and replying
Make reasonable efforts to find the information - email, files, systems and paper records - but you don't have to carry out searches that are disproportionate. Usually you can't charge a fee. Send a copy of the data plus the supporting information (why you hold it, who you share it with, how long you keep it).
Keep a record
Log the date received, ID checks, any extension and when you told the person, what you sent and when. If the person complains to the ICO, that record is your evidence.