An individual can ask you to tell them about any personal information you hold about them, and to provide them with a copy of that information.
Any written request by an individual asking for their personal information is a subject access request. In most cases you must respond within 40 calendar days of receiving it.
The first thing to do is to ensure you have enough information to adequately confirm their identity.
IF NOT DO NOT RELEASE IT.
PS you can charge a fee for data subject access requests.