2 ms·

Since he's making the request under the GDPR, yes; if the data relates to him, it's his personal data.