Unless the company can prove that the SAR request goes beyond simply exercising data privacy rights it cannot refuse legitimate personal data requests.