Key to the GDPR are “Subject Access Requests”. Dyann Heward-Mills explains what these are and how companies need to respond.