What is a Subject Access Request (SAR) or a Data Subject Access Request (DSAR)? This is the right of an individual to see any information held about them by an organisation. Someone can make a request by any method they choose, including verbally. This is creating some challenges as most organisations are struggling to put a process in place to recognise verbal requests.
A friend of mine made a verbal request to a local authority before Christmas. They were told all requests had to be in writing, then my friend told them a verbal request was a valid request. 
Needless to say the local authority did not act on the request and now a month later, my friend has raised a complaint with the local authority failing to handle a verbal request within the required 30 days.
The Information Commissioners Office is keen to see that people can exercise their right to see their information and frequently receive complaints about organisations which have failed to provide the requested information. 47% of all complaints received by the Information Commissioners Office in 2017 related to subject access requests.
SCL Elections (the parent company of Cambridge Analytica) were fined £15,000 recently for failing to comply with a subject access request.
Would your staff be able to recognise a verbal request for information and if they did recognise a request, would they know who it should be referred to?
Subject access requests can be complex, time consuming and frequently lead to complaints being made to the relevant supervisory body. You need to have a robust process in place and ensure that staff are trained to recognise a request, however it is received.