Add right requests

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/authz/permissions.go

@@ -92,6 +92,7 @@ const (
 	ActionListComplianceReports       Action = "listComplianceReports"
 	ActionListContacts                Action = "listContacts"
 	ActionListContinualImprovements   Action = "listContinualImprovements"
+	ActionListRightsRequests           Action = "listRightsRequests"
 	ActionListControls                Action = "listControls"
 	ActionListData                    Action = "listData"
 	ActionListDocuments               Action = "listDocuments"
@@ -122,6 +123,7 @@ const (
 	ActionCreateAsset                          Action = "createAsset"
 	ActionCreateAudit                          Action = "createAudit"
 	ActionCreateContinualImprovement           Action = "createContinualImprovement"
+	ActionCreateRightsRequest                  Action = "createRightsRequest"
 	ActionCreateControl                        Action = "createControl"
 	ActionCreateControlAuditMapping            Action = "createControlAuditMapping"
 	ActionCreateControlDocumentMapping         Action = "createControlDocumentMapping"
@@ -159,6 +161,7 @@ const (
 	ActionUpdateAsset                            Action = "updateAsset"
 	ActionUpdateAudit                            Action = "updateAudit"
 	ActionUpdateContinualImprovement             Action = "updateContinualImprovement"
+	ActionUpdateRightsRequest                    Action = "updateRightsRequest"
 	ActionUpdateControl                          Action = "updateControl"
 	ActionUpdateDatum                            Action = "updateDatum"
 	ActionUpdateDocument                         Action = "updateDocument"
@@ -191,6 +194,7 @@ const (
 	ActionDeleteAudit                            Action = "deleteAudit"
 	ActionDeleteAuditReport                      Action = "deleteAuditReport"
 	ActionDeleteContinualImprovement             Action = "deleteContinualImprovement"
+	ActionDeleteRightsRequest                    Action = "deleteRightsRequest"
 	ActionDeleteControl                          Action = "deleteControl"
 	ActionDeleteControlAuditMapping              Action = "deleteControlAuditMapping"
 	ActionDeleteControlDocumentMapping           Action = "deleteControlDocumentMapping"
@@ -299,6 +303,7 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionListNonconformities:       NonEmployeeRoles,
 		ActionListObligations:           NonEmployeeRoles,
 		ActionListContinualImprovements: NonEmployeeRoles,
+		ActionListRightsRequests:         NonEmployeeRoles,
 		ActionListProcessingActivities:  NonEmployeeRoles,
 		ActionListSnapshots:             NonEmployeeRoles,
 		ActionConfirmEmail:              NonEmployeeRoles,
@@ -337,6 +342,7 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionCreateNonconformity:              EditRoles,
 		ActionCreateObligation:                 EditRoles,
 		ActionCreateContinualImprovement:       EditRoles,
+		ActionCreateRightsRequest:              EditRoles,
 		ActionCreateProcessingActivity:         EditRoles,
 		ActionCreateSnapshot:                   EditRoles,
 		ActionCreateTrustCenterFile:            EditRoles,
@@ -674,6 +680,13 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionUpdateContinualImprovement: EditRoles,
 		ActionDeleteContinualImprovement: EditRoles,
 	},
+	coredata.RightsRequestEntityType: {
+		ActionGet:             NonEmployeeRoles,
+		ActionGetOrganization: NonEmployeeRoles,
+
+		ActionUpdateRightsRequest: EditRoles,
+		ActionDeleteRightsRequest: EditRoles,
+	},
 	coredata.ProcessingActivityEntityType: {
 		ActionGet:                               NonEmployeeRoles,
 		ActionGetOrganization:                   NonEmployeeRoles,

pkg/coredata/entity_type_reg.go

@@ -69,6 +69,7 @@ const (
 	MeetingEntityType                          uint16 = 45
 	DataProtectionImpactAssessmentEntityType   uint16 = 46
 	TransferImpactAssessmentEntityType         uint16 = 47
+	RightsRequestEntityType                    uint16 = 48
 )
 
 type EntityInfo struct {
@@ -269,6 +270,10 @@ var entityRegistry = map[uint16]EntityInfo{
 		Model: "TransferImpactAssessment",
 		Table: "processing_activity_transfer_impact_assessments",
 	},
+	RightsRequestEntityType: {
+		Model: "RightsRequest",
+		Table: "rights_requests",
+	},
 }
 
 func EntityTable(entityType uint16) (string, bool) {

pkg/coredata/migrations/20251226T130238Z.sql

@@ -0,0 +1,37 @@
+CREATE TYPE rights_request_type AS ENUM (
+    'ACCESS',
+    'DELETION',
+    'PORTABILITY'
+);
+
+CREATE TYPE rights_request_state AS ENUM (
+    'TODO',
+    'IN_PROGRESS',
+    'DONE'
+);
+
+CREATE TABLE rights_requests (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL,
+
+    request_type rights_request_type NOT NULL,
+    request_state rights_request_state NOT NULL,
+
+    data_subject TEXT,
+    contact TEXT,
+    details TEXT,
+
+    deadline DATE,
+
+    action_taken TEXT,
+
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT rights_requests_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);

pkg/coredata/rights_request_order_field.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type RightsRequestOrderField string
+
+const (
+	RightsRequestOrderFieldCreatedAt RightsRequestOrderField = "CREATED_AT"
+	RightsRequestOrderFieldDeadline  RightsRequestOrderField = "DEADLINE"
+	RightsRequestOrderFieldState     RightsRequestOrderField = "STATE"
+	RightsRequestOrderFieldType      RightsRequestOrderField = "TYPE"
+)
+
+func (p RightsRequestOrderField) Column() string {
+	return string(p)
+}
+
+func (p RightsRequestOrderField) String() string {
+	return string(p)
+}
+
+func (p RightsRequestOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *RightsRequestOrderField) UnmarshalText(text []byte) error {
+	*p = RightsRequestOrderField(text)
+	return nil
+}

pkg/coredata/rights_request_state.go

@@ -0,0 +1,68 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type RightsRequestState string
+
+const (
+	RightsRequestStateTodo       RightsRequestState = "TODO"
+	RightsRequestStateInProgress RightsRequestState = "IN_PROGRESS"
+	RightsRequestStateDone       RightsRequestState = "DONE"
+)
+
+func RightsRequestStates() []RightsRequestState {
+	return []RightsRequestState{
+		RightsRequestStateTodo,
+		RightsRequestStateInProgress,
+		RightsRequestStateDone,
+	}
+}
+
+func (rrs RightsRequestState) String() string {
+	return string(rrs)
+}
+
+func (rrs *RightsRequestState) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for RightsRequestState: %T", value)
+	}
+
+	switch s {
+	case "TODO":
+		*rrs = RightsRequestStateTodo
+	case "IN_PROGRESS":
+		*rrs = RightsRequestStateInProgress
+	case "DONE":
+		*rrs = RightsRequestStateDone
+	default:
+		return fmt.Errorf("invalid RightsRequestState value: %q", s)
+	}
+	return nil
+}
+
+func (rrs RightsRequestState) Value() (driver.Value, error) {
+	return string(rrs), nil
+}

pkg/coredata/rights_request_type.go

@@ -0,0 +1,68 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type RightsRequestType string
+
+const (
+	RightsRequestTypeAccess     RightsRequestType = "ACCESS"
+	RightsRequestTypeDeletion   RightsRequestType = "DELETION"
+	RightsRequestTypePortability RightsRequestType = "PORTABILITY"
+)
+
+func RightsRequestTypes() []RightsRequestType {
+	return []RightsRequestType{
+		RightsRequestTypeAccess,
+		RightsRequestTypeDeletion,
+		RightsRequestTypePortability,
+	}
+}
+
+func (rrt RightsRequestType) String() string {
+	return string(rrt)
+}
+
+func (rrt *RightsRequestType) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for RightsRequestType: %T", value)
+	}
+
+	switch s {
+	case "ACCESS":
+		*rrt = RightsRequestTypeAccess
+	case "DELETION":
+		*rrt = RightsRequestTypeDeletion
+	case "PORTABILITY":
+		*rrt = RightsRequestTypePortability
+	default:
+		return fmt.Errorf("invalid RightsRequestType value: %q", s)
+	}
+	return nil
+}
+
+func (rrt RightsRequestType) Value() (driver.Value, error) {
+	return string(rrt), nil
+}

pkg/coredata/rights_requests.go

@@ -0,0 +1,327 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	ErrRightsRequestNotFound struct {
+		Identifier string
+	}
+
+	RightsRequest struct {
+		ID             gid.GID            `db:"id"`
+		OrganizationID gid.GID            `db:"organization_id"`
+		RequestType    RightsRequestType  `db:"request_type"`
+		RequestState   RightsRequestState `db:"request_state"`
+		DataSubject    *string            `db:"data_subject"`
+		Contact        *string            `db:"contact"`
+		Details        *string            `db:"details"`
+		Deadline       *time.Time         `db:"deadline"`
+		ActionTaken    *string            `db:"action_taken"`
+		CreatedAt      time.Time          `db:"created_at"`
+		UpdatedAt      time.Time          `db:"updated_at"`
+	}
+
+	RightsRequests []*RightsRequest
+)
+
+func (e ErrRightsRequestNotFound) Error() string {
+	return fmt.Sprintf("rights request not found: %q", e.Identifier)
+}
+
+func (rr *RightsRequest) CursorKey(field RightsRequestOrderField) page.CursorKey {
+	switch field {
+	case RightsRequestOrderFieldCreatedAt:
+		return page.NewCursorKey(rr.ID, rr.CreatedAt)
+	case RightsRequestOrderFieldDeadline:
+		return page.NewCursorKey(rr.ID, rr.Deadline)
+	case RightsRequestOrderFieldState:
+		return page.NewCursorKey(rr.ID, rr.RequestState)
+	case RightsRequestOrderFieldType:
+		return page.NewCursorKey(rr.ID, rr.RequestType)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
+}
+
+func (rr *RightsRequest) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	rightsRequestID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	request_type,
+	request_state,
+	data_subject,
+	contact,
+	details,
+	deadline,
+	action_taken,
+	created_at,
+	updated_at
+FROM
+	rights_requests
+WHERE
+	%s
+	AND id = @rights_request_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"rights_request_id": rightsRequestID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query rights request: %w", err)
+	}
+
+	request, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[RightsRequest])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrRightsRequestNotFound{Identifier: rightsRequestID.String()}
+		}
+
+		return fmt.Errorf("cannot collect rights request: %w", err)
+	}
+
+	*rr = request
+
+	return nil
+}
+
+func (rrs *RightsRequests) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	rights_requests
+WHERE
+	%s
+	AND organization_id = @organization_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count rights requests: %w", err)
+	}
+
+	return count, nil
+}
+
+func (rrs *RightsRequests) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[RightsRequestOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	request_type,
+	request_state,
+	data_subject,
+	contact,
+	details,
+	deadline,
+	action_taken,
+	created_at,
+	updated_at
+FROM
+	rights_requests
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query rights requests: %w", err)
+	}
+
+	requests, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[RightsRequest])
+	if err != nil {
+		return fmt.Errorf("cannot collect rights requests: %w", err)
+	}
+
+	*rrs = requests
+
+	return nil
+}
+
+func (rr *RightsRequest) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO rights_requests (
+	id,
+	tenant_id,
+	organization_id,
+	request_type,
+	request_state,
+	data_subject,
+	contact,
+	details,
+	deadline,
+	action_taken,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@request_type,
+	@request_state,
+	@data_subject,
+	@contact,
+	@details,
+	@deadline,
+	@action_taken,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              rr.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": rr.OrganizationID,
+		"request_type":    rr.RequestType,
+		"request_state":   rr.RequestState,
+		"data_subject":    rr.DataSubject,
+		"contact":         rr.Contact,
+		"details":         rr.Details,
+		"deadline":        rr.Deadline,
+		"action_taken":    rr.ActionTaken,
+		"created_at":      rr.CreatedAt,
+		"updated_at":      rr.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert rights request: %w", err)
+	}
+
+	return nil
+}
+
+func (rr *RightsRequest) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE rights_requests SET
+	request_type = @request_type,
+	request_state = @request_state,
+	data_subject = @data_subject,
+	contact = @contact,
+	details = @details,
+	deadline = @deadline,
+	action_taken = @action_taken,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":            rr.ID,
+		"request_type":  rr.RequestType,
+		"request_state": rr.RequestState,
+		"data_subject":  rr.DataSubject,
+		"contact":       rr.Contact,
+		"details":       rr.Details,
+		"deadline":      rr.Deadline,
+		"action_taken":  rr.ActionTaken,
+		"updated_at":    rr.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update rights request: %w", err)
+	}
+
+	return nil
+}
+
+func (rr *RightsRequest) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM rights_requests
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": rr.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete rights request: %w", err)
+	}
+
+	return nil
+}

pkg/probo/rights_request_service.go

@@ -0,0 +1,291 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type RightsRequestService struct {
+	svc *TenantService
+}
+
+type (
+	CreateRightsRequestRequest struct {
+		OrganizationID gid.GID
+		RequestType    *coredata.RightsRequestType
+		RequestState   *coredata.RightsRequestState
+		DataSubject    *string
+		Contact        *string
+		Details        *string
+		Deadline       *time.Time
+		ActionTaken    *string
+	}
+
+	UpdateRightsRequestRequest struct {
+		ID           gid.GID
+		RequestType  *coredata.RightsRequestType
+		RequestState *coredata.RightsRequestState
+		DataSubject  **string
+		Contact      **string
+		Details      **string
+		Deadline     **time.Time
+		ActionTaken  **string
+	}
+)
+
+func (crrr *CreateRightsRequestRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(crrr.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
+	v.Check(crrr.RequestType, "request_type", validator.Required(), validator.OneOfSlice(coredata.RightsRequestTypes()))
+	v.Check(crrr.RequestState, "request_state", validator.Required(), validator.OneOfSlice(coredata.RightsRequestStates()))
+	v.Check(crrr.DataSubject, "data_subject", validator.SafeText(ContentMaxLength))
+	v.Check(crrr.Contact, "contact", validator.SafeText(ContentMaxLength))
+	v.Check(crrr.Details, "details", validator.SafeText(ContentMaxLength))
+	v.Check(crrr.ActionTaken, "action_taken", validator.SafeText(ContentMaxLength))
+
+	return v.Error()
+}
+
+func (urrr *UpdateRightsRequestRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(urrr.ID, "id", validator.Required(), validator.GID(coredata.RightsRequestEntityType))
+	v.Check(urrr.RequestType, "request_type", validator.OneOfSlice(coredata.RightsRequestTypes()))
+	v.Check(urrr.RequestState, "request_state", validator.OneOfSlice(coredata.RightsRequestStates()))
+	v.Check(urrr.DataSubject, "data_subject", validator.SafeText(ContentMaxLength))
+	v.Check(urrr.Contact, "contact", validator.SafeText(ContentMaxLength))
+	v.Check(urrr.Details, "details", validator.SafeText(ContentMaxLength))
+	v.Check(urrr.ActionTaken, "action_taken", validator.SafeText(ContentMaxLength))
+
+	return v.Error()
+}
+
+func (s RightsRequestService) Get(
+	ctx context.Context,
+	rightsRequestID gid.GID,
+) (*coredata.RightsRequest, error) {
+	request := &coredata.RightsRequest{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := request.LoadByID(ctx, conn, s.svc.scope, rightsRequestID); err != nil {
+				return fmt.Errorf("cannot load rights request: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return request, nil
+}
+
+func (s *RightsRequestService) Create(
+	ctx context.Context,
+	req *CreateRightsRequestRequest,
+) (*coredata.RightsRequest, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+
+	request := &coredata.RightsRequest{
+		ID:             gid.New(s.svc.scope.GetTenantID(), coredata.RightsRequestEntityType),
+		OrganizationID: req.OrganizationID,
+		RequestType:    *req.RequestType,
+		RequestState:   *req.RequestState,
+		DataSubject:    req.DataSubject,
+		Contact:        req.Contact,
+		Details:        req.Details,
+		Deadline:       req.Deadline,
+		ActionTaken:    req.ActionTaken,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			organization := &coredata.Organization{}
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			if err := request.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert rights request: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return request, nil
+}
+
+func (s *RightsRequestService) Update(
+	ctx context.Context,
+	req *UpdateRightsRequestRequest,
+) (*coredata.RightsRequest, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	request := &coredata.RightsRequest{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := request.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load rights request: %w", err)
+			}
+
+			if req.RequestType != nil {
+				request.RequestType = *req.RequestType
+			}
+
+			if req.RequestState != nil {
+				request.RequestState = *req.RequestState
+			}
+
+			if req.DataSubject != nil {
+				request.DataSubject = *req.DataSubject
+			}
+
+			if req.Contact != nil {
+				request.Contact = *req.Contact
+			}
+
+			if req.Details != nil {
+				request.Details = *req.Details
+			}
+
+			if req.Deadline != nil {
+				request.Deadline = *req.Deadline
+			}
+
+			if req.ActionTaken != nil {
+				request.ActionTaken = *req.ActionTaken
+			}
+
+			request.UpdatedAt = time.Now()
+
+			if err := request.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update rights request: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return request, nil
+}
+
+func (s *RightsRequestService) Delete(
+	ctx context.Context,
+	rightsRequestID gid.GID,
+) error {
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			request := &coredata.RightsRequest{}
+			if err := request.LoadByID(ctx, conn, s.svc.scope, rightsRequestID); err != nil {
+				return fmt.Errorf("cannot load rights request: %w", err)
+			}
+
+			if err := request.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete rights request: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	return err
+}
+
+func (s RightsRequestService) CountByOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			requests := coredata.RightsRequests{}
+			count, err = requests.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID)
+			if err != nil {
+				return fmt.Errorf("cannot count rights requests: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s RightsRequestService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.RightsRequestOrderField],
+) (*page.Page[*coredata.RightsRequest, coredata.RightsRequestOrderField], error) {
+	var requests coredata.RightsRequests
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := requests.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load rights requests: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(requests, cursor), nil
+}

pkg/probo/service.go

@@ -113,6 +113,7 @@ type (
 		Obligations                       *ObligationService
 		Snapshots                         *SnapshotService
 		ContinualImprovements             *ContinualImprovementService
+		RightsRequests                    *RightsRequestService
 		ProcessingActivities              *ProcessingActivityService
 		DataProtectionImpactAssessments   *DataProtectionImpactAssessmentService
 		TransferImpactAssessments         *TransferImpactAssessmentService
@@ -250,6 +251,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Obligations = &ObligationService{svc: tenantService}
 	tenantService.Snapshots = &SnapshotService{svc: tenantService}
 	tenantService.ContinualImprovements = &ContinualImprovementService{svc: tenantService}
+	tenantService.RightsRequests = &RightsRequestService{svc: tenantService}
 	tenantService.ProcessingActivities = &ProcessingActivityService{svc: tenantService}
 	tenantService.DataProtectionImpactAssessments = &DataProtectionImpactAssessmentService{svc: tenantService}
 	tenantService.TransferImpactAssessments = &TransferImpactAssessmentService{svc: tenantService}

pkg/server/api/console/v1/schema.graphql

@@ -260,6 +260,42 @@ enum ContinualImprovementPriority
     )
 }
 
+enum RightsRequestType
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.RightsRequestType"
+  ) {
+  ACCESS
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeAccess"
+    )
+  DELETION
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeDeletion"
+    )
+  PORTABILITY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypePortability"
+    )
+}
+
+enum RightsRequestState
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.RightsRequestState"
+  ) {
+  TODO
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateTodo"
+    )
+  IN_PROGRESS
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateInProgress"
+    )
+  DONE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateDone"
+    )
+}
+
 enum ProcessingActivitySpecialOrCriminalDatum
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.ProcessingActivitySpecialOrCriminalDatum"
@@ -1065,6 +1101,28 @@ enum ContinualImprovementOrderField
     )
 }
 
+enum RightsRequestOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.RightsRequestOrderField"
+  ) {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestOrderFieldCreatedAt"
+    )
+  DEADLINE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestOrderFieldDeadline"
+    )
+  STATE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestOrderFieldState"
+    )
+  TYPE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.RightsRequestOrderFieldType"
+    )
+}
+
 enum ProcessingActivityOrderField
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.ProcessingActivityOrderField"
@@ -1344,6 +1402,14 @@ input ContinualImprovementOrder
   field: ContinualImprovementOrderField!
 }
 
+input RightsRequestOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RightsRequestOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: RightsRequestOrderField!
+}
+
 input ProcessingActivityOrder
   @goModel(
     model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ProcessingActivityOrderBy"
@@ -1513,6 +1579,7 @@ input ContinualImprovementFilter {
   snapshotId: ID
 }
 
+
 input ProcessingActivityFilter {
   snapshotId: ID
 }
@@ -1727,6 +1794,14 @@ type Organization implements Node {
     filter: ContinualImprovementFilter = { snapshotId: null }
   ): ContinualImprovementConnection! @goField(forceResolver: true)
 
+  rightsRequests(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: RightsRequestOrder
+  ): RightsRequestConnection! @goField(forceResolver: true)
+
   processingActivities(
     first: Int
     after: CursorKey
@@ -2326,6 +2401,20 @@ type ContinualImprovement implements Node {
   updatedAt: Datetime!
 }
 
+type RightsRequest implements Node {
+  id: ID!
+  organization: Organization! @goField(forceResolver: true)
+  requestType: RightsRequestType!
+  requestState: RightsRequestState!
+  dataSubject: String
+  contact: String
+  details: String
+  deadline: Datetime
+  actionTaken: String
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type ProcessingActivity implements Node {
   id: ID!
   snapshotId: ID
@@ -2879,6 +2968,20 @@ type ContinualImprovementEdge {
   node: ContinualImprovement!
 }
 
+type RightsRequestConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RightsRequestConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [RightsRequestEdge!]!
+  pageInfo: PageInfo!
+}
+
+type RightsRequestEdge {
+  cursor: CursorKey!
+  node: RightsRequest!
+}
+
 type ProcessingActivityConnection
   @goModel(
     model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ProcessingActivityConnection"
@@ -3246,6 +3349,20 @@ type Mutation {
   deleteContinualImprovement(
     input: DeleteContinualImprovementInput!
   ): DeleteContinualImprovementPayload!
+
+  # Rights Request mutations
+  createRightsRequest(
+    input: CreateRightsRequestInput!
+  ): CreateRightsRequestPayload!
+
+  updateRightsRequest(
+    input: UpdateRightsRequestInput!
+  ): UpdateRightsRequestPayload!
+
+  deleteRightsRequest(
+    input: DeleteRightsRequestInput!
+  ): DeleteRightsRequestPayload!
+
   # Processing Activity mutations
   createProcessingActivity(
     input: CreateProcessingActivityInput!
@@ -4022,6 +4139,32 @@ input DeleteContinualImprovementInput {
   continualImprovementId: ID!
 }
 
+input CreateRightsRequestInput {
+  organizationId: ID!
+  requestType: RightsRequestType!
+  requestState: RightsRequestState!
+  dataSubject: String
+  contact: String
+  details: String
+  deadline: Datetime
+  actionTaken: String
+}
+
+input UpdateRightsRequestInput {
+  id: ID!
+  requestType: RightsRequestType
+  requestState: RightsRequestState
+  dataSubject: String @goField(omittable: true)
+  contact: String @goField(omittable: true)
+  details: String @goField(omittable: true)
+  deadline: Datetime @goField(omittable: true)
+  actionTaken: String @goField(omittable: true)
+}
+
+input DeleteRightsRequestInput {
+  rightsRequestId: ID!
+}
+
 input CreateProcessingActivityInput {
   organizationId: ID!
   name: String!
@@ -4964,6 +5107,18 @@ type DeleteContinualImprovementPayload {
   deletedContinualImprovementId: ID!
 }
 
+type CreateRightsRequestPayload {
+  rightsRequestEdge: RightsRequestEdge!
+}
+
+type UpdateRightsRequestPayload {
+  rightsRequest: RightsRequest!
+}
+
+type DeleteRightsRequestPayload {
+  deletedRightsRequestId: ID!
+}
+
 type CreateProcessingActivityPayload {
   processingActivityEdge: ProcessingActivityEdge!
 }

pkg/server/api/console/v1/types/rights_request.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	RightsRequestOrderBy OrderBy[coredata.RightsRequestOrderField]
+
+	RightsRequestConnection struct {
+		TotalCount int
+		Edges      []*RightsRequestEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewRightsRequestConnection(
+	p *page.Page[*coredata.RightsRequest, coredata.RightsRequestOrderField],
+	parentType any,
+	parentID gid.GID,
+) *RightsRequestConnection {
+	edges := make([]*RightsRequestEdge, len(p.Data))
+	for i, request := range p.Data {
+		edges[i] = NewRightsRequestEdge(request, p.Cursor.OrderBy.Field)
+	}
+
+	return &RightsRequestConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewRightsRequest(rr *coredata.RightsRequest) *RightsRequest {
+	return &RightsRequest{
+		ID:           rr.ID,
+		RequestType:  rr.RequestType,
+		RequestState: rr.RequestState,
+		DataSubject:  rr.DataSubject,
+		Contact:      rr.Contact,
+		Details:      rr.Details,
+		Deadline:     rr.Deadline,
+		ActionTaken:  rr.ActionTaken,
+		CreatedAt:    rr.CreatedAt,
+		UpdatedAt:    rr.UpdatedAt,
+	}
+}
+
+func NewRightsRequestEdge(rr *coredata.RightsRequest, orderField coredata.RightsRequestOrderField) *RightsRequestEdge {
+	return &RightsRequestEdge{
+		Node:   NewRightsRequest(rr),
+		Cursor: rr.CursorKey(orderField),
+	}
+}

pkg/server/api/console/v1/types/types.go

@@ -464,6 +464,21 @@ type CreateProcessingActivityPayload struct {
 	ProcessingActivityEdge *ProcessingActivityEdge `json:"processingActivityEdge"`
 }
 
+type CreateRightsRequestInput struct {
+	OrganizationID gid.GID                     `json:"organizationId"`
+	RequestType    coredata.RightsRequestType  `json:"requestType"`
+	RequestState   coredata.RightsRequestState `json:"requestState"`
+	DataSubject    *string                     `json:"dataSubject,omitempty"`
+	Contact        *string                     `json:"contact,omitempty"`
+	Details        *string                     `json:"details,omitempty"`
+	Deadline       *time.Time                  `json:"deadline,omitempty"`
+	ActionTaken    *string                     `json:"actionTaken,omitempty"`
+}
+
+type CreateRightsRequestPayload struct {
+	RightsRequestEdge *RightsRequestEdge `json:"rightsRequestEdge"`
+}
+
 type CreateRiskDocumentMappingInput struct {
 	RiskID     gid.GID `json:"riskId"`
 	DocumentID gid.GID `json:"documentId"`
@@ -934,6 +949,14 @@ type DeleteProcessingActivityPayload struct {
 	DeletedProcessingActivityID gid.GID `json:"deletedProcessingActivityId"`
 }
 
+type DeleteRightsRequestInput struct {
+	RightsRequestID gid.GID `json:"rightsRequestId"`
+}
+
+type DeleteRightsRequestPayload struct {
+	DeletedRightsRequestID gid.GID `json:"deletedRightsRequestId"`
+}
+
 type DeleteRiskDocumentMappingInput struct {
 	RiskID     gid.GID `json:"riskId"`
 	DocumentID gid.GID `json:"documentId"`
@@ -1515,6 +1538,7 @@ type Organization struct {
 	Nonconformities                 *NonconformityConnection                  `json:"nonconformities"`
 	Obligations                     *ObligationConnection                     `json:"obligations"`
 	ContinualImprovements           *ContinualImprovementConnection           `json:"continualImprovements"`
+	RightsRequests                  *RightsRequestConnection                  `json:"rightsRequests"`
 	ProcessingActivities            *ProcessingActivityConnection             `json:"processingActivities"`
 	DataProtectionImpactAssessments *DataProtectionImpactAssessmentConnection `json:"dataProtectionImpactAssessments"`
 	TransferImpactAssessments       *TransferImpactAssessmentConnection       `json:"transferImpactAssessments"`
@@ -1682,6 +1706,28 @@ type RequestSignaturePayload struct {
 	DocumentVersionSignatureEdge *DocumentVersionSignatureEdge `json:"documentVersionSignatureEdge"`
 }
 
+type RightsRequest struct {
+	ID           gid.GID                     `json:"id"`
+	Organization *Organization               `json:"organization"`
+	RequestType  coredata.RightsRequestType  `json:"requestType"`
+	RequestState coredata.RightsRequestState `json:"requestState"`
+	DataSubject  *string                     `json:"dataSubject,omitempty"`
+	Contact      *string                     `json:"contact,omitempty"`
+	Details      *string                     `json:"details,omitempty"`
+	Deadline     *time.Time                  `json:"deadline,omitempty"`
+	ActionTaken  *string                     `json:"actionTaken,omitempty"`
+	CreatedAt    time.Time                   `json:"createdAt"`
+	UpdatedAt    time.Time                   `json:"updatedAt"`
+}
+
+func (RightsRequest) IsNode()             {}
+func (this RightsRequest) GetID() gid.GID { return this.ID }
+
+type RightsRequestEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *RightsRequest `json:"node"`
+}
+
 type Risk struct {
 	ID                 gid.GID                `json:"id"`
 	SnapshotID         *gid.GID               `json:"snapshotId,omitempty"`
@@ -2199,6 +2245,21 @@ type UpdateProcessingActivityPayload struct {
 	ProcessingActivity *ProcessingActivity `json:"processingActivity"`
 }
 
+type UpdateRightsRequestInput struct {
+	ID           gid.GID                       `json:"id"`
+	RequestType  *coredata.RightsRequestType   `json:"requestType,omitempty"`
+	RequestState *coredata.RightsRequestState  `json:"requestState,omitempty"`
+	DataSubject  graphql.Omittable[*string]    `json:"dataSubject,omitempty"`
+	Contact      graphql.Omittable[*string]    `json:"contact,omitempty"`
+	Details      graphql.Omittable[*string]    `json:"details,omitempty"`
+	Deadline     graphql.Omittable[*time.Time] `json:"deadline,omitempty"`
+	ActionTaken  graphql.Omittable[*string]    `json:"actionTaken,omitempty"`
+}
+
+type UpdateRightsRequestPayload struct {
+	RightsRequest *RightsRequest `json:"rightsRequest"`
+}
+
 type UpdateRiskInput struct {
 	ID                 gid.GID                     `json:"id"`
 	Name               *string                     `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -4243,6 +4243,76 @@ func (r *mutationResolver) DeleteContinualImprovement(ctx context.Context, input
 	}, nil
 }
 
+// CreateRightsRequest is the resolver for the createRightsRequest field.
+func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types.CreateRightsRequestInput) (*types.CreateRightsRequestPayload, error) {
+	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateRightsRequest)
+
+	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
+
+	req := probo.CreateRightsRequestRequest{
+		OrganizationID: input.OrganizationID,
+		RequestType:    &input.RequestType,
+		RequestState:   &input.RequestState,
+		DataSubject:    input.DataSubject,
+		Contact:        input.Contact,
+		Details:        input.Details,
+		Deadline:       input.Deadline,
+		ActionTaken:    input.ActionTaken,
+	}
+
+	rightsRequest, err := prb.RightsRequests.Create(ctx, &req)
+	if err != nil {
+		panic(fmt.Errorf("cannot create rights request: %w", err))
+	}
+
+	return &types.CreateRightsRequestPayload{
+		RightsRequestEdge: types.NewRightsRequestEdge(rightsRequest, coredata.RightsRequestOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateRightsRequest is the resolver for the updateRightsRequest field.
+func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types.UpdateRightsRequestInput) (*types.UpdateRightsRequestPayload, error) {
+	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateRightsRequest)
+
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	req := probo.UpdateRightsRequestRequest{
+		ID:           input.ID,
+		RequestType:  input.RequestType,
+		RequestState: input.RequestState,
+		DataSubject:  UnwrapOmittable(input.DataSubject),
+		Contact:      UnwrapOmittable(input.Contact),
+		Details:      UnwrapOmittable(input.Details),
+		Deadline:     UnwrapOmittable(input.Deadline),
+		ActionTaken:  UnwrapOmittable(input.ActionTaken),
+	}
+
+	rightsRequest, err := prb.RightsRequests.Update(ctx, &req)
+	if err != nil {
+		panic(fmt.Errorf("cannot update rights request: %w", err))
+	}
+
+	return &types.UpdateRightsRequestPayload{
+		RightsRequest: types.NewRightsRequest(rightsRequest),
+	}, nil
+}
+
+// DeleteRightsRequest is the resolver for the deleteRightsRequest field.
+func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types.DeleteRightsRequestInput) (*types.DeleteRightsRequestPayload, error) {
+	r.MustBeAuthorized(ctx, input.RightsRequestID, authz.ActionDeleteRightsRequest)
+
+	prb := r.ProboService(ctx, input.RightsRequestID.TenantID())
+
+	err := prb.RightsRequests.Delete(ctx, input.RightsRequestID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete rights request: %w", err))
+	}
+
+	return &types.DeleteRightsRequestPayload{
+		DeletedRightsRequestID: input.RightsRequestID,
+	}, nil
+}
+
 // CreateProcessingActivity is the resolver for the createProcessingActivity field.
 func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input types.CreateProcessingActivityInput) (*types.CreateProcessingActivityPayload, error) {
 	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateProcessingActivity)
@@ -5535,6 +5605,34 @@ func (r *organizationResolver) ContinualImprovements(ctx context.Context, obj *t
 	return types.NewContinualImprovementConnection(page, r, obj.ID, filter), nil
 }
 
+// RightsRequests is the resolver for the rightsRequests field.
+func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RightsRequestOrderBy) (*types.RightsRequestConnection, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListRightsRequests)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.RightsRequestOrderField]{
+		Field:     coredata.RightsRequestOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.RightsRequestOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := prb.RightsRequests.ListForOrganizationID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization rights requests: %w", err))
+	}
+
+	return types.NewRightsRequestConnection(page, r, obj.ID), nil
+}
+
 // ProcessingActivities is the resolver for the processingActivities field.
 func (r *organizationResolver) ProcessingActivities(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProcessingActivityOrderBy, filter *types.ProcessingActivityFilter) (*types.ProcessingActivityConnection, error) {
 	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListProcessingActivities)
@@ -6146,6 +6244,17 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewMeeting(meeting), nil
+	case coredata.RightsRequestEntityType:
+		rightsRequest, err := prb.RightsRequests.Get(ctx, id)
+		if err != nil {
+			var errNotFound *coredata.ErrRightsRequestNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, gqlutils.NotFound(errNotFound)
+			}
+			panic(fmt.Errorf("cannot get rights request: %w", err))
+		}
+
+		return types.NewRightsRequest(rightsRequest), nil
 	default:
 	}
 
@@ -6201,6 +6310,48 @@ func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.A
 	return types.NewAudit(audit), nil
 }
 
+// Organization is the resolver for the organization field.
+func (r *rightsRequestResolver) Organization(ctx context.Context, obj *types.RightsRequest) (*types.Organization, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionGetOrganization)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	rightsRequest, err := prb.RightsRequests.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get rights request: %w", err))
+	}
+
+	organization, err := prb.Organizations.Get(ctx, rightsRequest.OrganizationID)
+	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get organization: %w", err))
+	}
+
+	return types.NewOrganization(organization), nil
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error) {
+	r.MustBeAuthorized(ctx, obj.ParentID, authz.ActionTotalCount)
+
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	switch obj.Resolver.(type) {
+	case *organizationResolver:
+		count, err := prb.RightsRequests.CountByOrganizationID(ctx, obj.ParentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot count rights requests: %w", err))
+		}
+
+		return count, nil
+	default:
+		panic(fmt.Errorf("unsupported resolver type for RightsRequestConnection: %T", obj.Resolver))
+	}
+}
+
 // Owner is the resolver for the owner field.
 func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.People, error) {
 	r.MustBeAuthorized(ctx, obj.ID, authz.ActionGetOwner)
@@ -7789,6 +7940,14 @@ func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
 // Report returns schema.ReportResolver implementation.
 func (r *Resolver) Report() schema.ReportResolver { return &reportResolver{r} }
 
+// RightsRequest returns schema.RightsRequestResolver implementation.
+func (r *Resolver) RightsRequest() schema.RightsRequestResolver { return &rightsRequestResolver{r} }
+
+// RightsRequestConnection returns schema.RightsRequestConnectionResolver implementation.
+func (r *Resolver) RightsRequestConnection() schema.RightsRequestConnectionResolver {
+	return &rightsRequestConnectionResolver{r}
+}
+
 // Risk returns schema.RiskResolver implementation.
 func (r *Resolver) Risk() schema.RiskResolver { return &riskResolver{r} }
 
@@ -7947,6 +8106,8 @@ type processingActivityResolver struct{ *Resolver }
 type processingActivityConnectionResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type reportResolver struct{ *Resolver }
+type rightsRequestResolver struct{ *Resolver }
+type rightsRequestConnectionResolver struct{ *Resolver }
 type riskResolver struct{ *Resolver }
 type riskConnectionResolver struct{ *Resolver }
 type sAMLConfigurationResolver struct{ *Resolver }