The ICO has issued new guidance on disclosing documents to the public. Although written for those responding to a Freedom of Information request (normally public authorities), there are some good lessons for us all as we respond to UK GDPR Data Subject Access Requests.
Have a look at https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/07/new-guidance-on-disclosing-documents-to-the-public/ and see what you can usefully incorporate into your data subject rights policy.