Citizens and small data holders face challenges in exercising GDPR rights, requiring innovative solutions like privacy dashboards and services.