We have been asked this question twice recently and so thought we would share the answer. According to the ICO at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-should-we-supply–information-to-the-requester/
The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. You may therefore provide the information in the form of transcripts of relevant documents (or of sections of documents that contain the personal data), or by providing a print-out of the relevant information from your computer systems. While it is reasonable to supply a transcript if it exists, we do not expect controllers to create new information to respond to a SAR. Although the easiest way to provide the relevant information is often to supply copies of original documents, you are not obliged to do so.
The whole ICO SAR document is helpful and talks about exceptions and exemptions, but always check with your DPO or Data Protection Lead as they are responsible for your policies in this area.
Of course, you can always book a free 25-minute insight call using the link https://zorva.info/free-insight-call/ to talk it through with us.