Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in r

Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t. As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy. Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it. Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.