Your organisation receives its first subject access request. Nobody knows where the person's data is. How do you respond within thirty days?

Start the clock formally and verify identity first

Record the date received. Verify the requester's identity robustly — responding to an impostor is itself a disclosure, and it is a worse outcome than a late response.

Verification can pause the clock in some regimes; confirm rather than assume.

Discovery, manually this time

Work from a list of systems rather than from memory:

• The operational database and its replicas.
• The analytical estate — warehouse, lakehouse, and every derived table.
• SaaS tools: CRM, support ticketing, marketing platform, analytics.
• Email and document stores.
• Logs, which routinely contain identifiers and sometimes payloads.
• Backups, and your stated position on them.
• Any partner or processor the data was pushed to.

For each, find the person by every identifier they might be keyed on — customer id, email, phone, account number — because a system keyed differently will not match on the obvious one.

Assemble intelligibly

Raw table extracts do not satisfy the obligation. The response must be understandable to the person, which means describing what each category of data is and why it is held.

Deliver securely, and record everything

What was searched, what was found, what was provided, what was withheld and on what basis. That record is the evidence if the response is challenged.

Then fix the process, because there will be more

A data inventory mapping where personal data lives and by which identifier, kept current as systems change. Without it, discovery is an investigation every time and does not scale past a handful of requests.

Identifier resolution, so one person can be found across systems keyed differently.

Processor obligations in contracts, with response times, because your thirty days includes their turnaround.

Automation of the search, once the inventory exists.

What to tell leadership

The first request is a process test and it has just failed in a controlled way. The next one may arrive alongside a complaint, and the remediation cost is far lower now.