When the company answers
After you send the request, they either ask for documents, refuse, or go silent. For each, what the law says and the next step.
They ask for documents
This is legitimate when the company has reasonable doubts about who you are. The law lets it ask for the information necessary to confirm your identity, and nothing more. If erasing a newsletter account gets you asked for a full ID card, the demand is disproportionate. You can reply that you will send only what confirms your identity, and mask what is not needed on the document, such as your address or tax number.
Article 12(6) and Article 5(1)(c) (data minimisation) GDPR
They refuse
A refusal must come with written reasons, within the same one-month deadline, and with the note that you can complain to the supervisory authority. Part of a refusal can be legitimate. The law makes the company keep some data for years, such as invoicing records. In that case it must erase the rest and say exactly what it keeps and under which obligation. A refusal without grounds, or one that never answers those grounds, goes to the regulator.
Article 12(4) and Article 17(3) GDPR
They go silent
The reply deadline is one month. Once it passes without a word, the regulator complaint is the next step, and the My requests page writes it with the dates of your case.
Article 12(3) and Article 77 GDPR