The General Data Protection Regulation (GDPR) has introduced various data subject rights, e.g., the right of access, the right to erasure, or the right to data portability. These rights empower European individuals, the data subjects, to exercise control over their personal data stored or processed by organizations, the data controllers, in multiple ways. However, in practice, the enforcement of those rights faces several issues, as especially small- and medium-sized enterprises often lack the resources or know-how to implement a sufficient data subject rights solution. This leads to incomplete results that are not easily comprehensible for the data subjects.

To address these issues we introduce the concept of Data Subject Rights as a Service (DSRaaS). The goal of the DSRaaS provider is to act as a bridge between the data subjects and data controllers, by providing the five services data subject right enforcement, authentication, data model, data logbook, and consulting. In this context, we will also look at the role that data intermediaries, introduced by the Data Governance Act, can serve in DSRaaS.