Ten years after the final text of the GDPR, we have gained significant insights from handling data subject requests. The "obvious" request—“I applied for a job at your company in April last year; can I get a copy of the data you have on me?”—has evolved. Now, we see third parties jumping in, requesting data for their clients and clearly stating that their requests are for reasons other than verifying the lawful processing of that personal data. In this workshop, we will conduct role-plays where you can step into different positions to better understand each perspective: data subject, mandated representative, controller, DPO, Supervisory Authority, and the like. We will also focus on the importance of correct identification and the security elements involved in transferring personal data.