[bennyp101]

The regulation doesn't specify how a Subject Access Request is delivered, they encourage you to send it in writing, but it doesn't have to be.

As a business, you cannot dictate how or where your customers/employees submit a SAR, so you need to be ready to pick up on the fact that it could be asked anywhere.

So it is actually worse, because you need to train all staff up to recognise a SAR in all areas that you communicate with customers.