With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May.
However, in the lead up to the law taking effect - a number of people have prematurely sent their SAR. That is, we have recieved SARs from before the 25th of May.
What is our legal liability in dealing with these? Must they be actioned, and if so - which day does the "month" start on?
Importantly, does this apply if an SAR was sent before 25th May, but was not first seen by an employee until after the 25th?