If the request is done in the context of GDPR, you cannot withhold data you have on a person. It is a person's right to know what you are gathering about this person and a request of that nature should be satisfied in full.
I have dealt with this since 2028 when GDPR became a law. A good tactic is to publish in the help files or T&C which fields you are actually collecting and for which purpose they are used.
It usually leads to an internal debate about needs and necessities.
If the request is done in the context of GDPR, you cannot withhold data you have on a person. It is a person's right to know what you are gathering about this person and a request of that nature should be satisfied in full.
I have dealt with this since 2028 when GDPR became a law. A good tactic is to publish in the help files or T&C which fields you are actually collecting and for which purpose they are used.
It usually leads to an internal debate about needs and necessities.
