'Data subject' is the GDPR's term for the person whose data is at the center of any privacy obligation. Where US laws often use 'consumer,' the GDPR's broader term reflects that privacy rights apply to any context where personal data is processed, including employment, healthcare, finance, and online activity.
Data subjects under the GDPR hold a set of enforceable rights: access, rectification, erasure (the 'right to be forgotten'), restriction of processing, data portability, and the right to object to certain types of processing including automated decision-making.
As privacy rights have expanded globally, the population of individuals who can make enforceable data subject requests has grown, and so has the volume of those requests.
Enterprises operating at scale receive thousands of requests annually from customers, former customers, employees, and individuals whose data was collected without a direct relationship. Fulfilling those requests accurately and within regulatory timelines requires automation across every system that holds personal data.