The search efforts businesses must make to meet data subject access requests (SARS) made under EU data protection law cannot be limited by what they consider to be proportionate, the European Data Protection Board (EDPB) has said.

https://www.pinsentmasons.com/out-law/news/eu-guidance-on-data-subject-access-requests-clarifies-search-obligations