I'm not very familiar with the legislation. Is a company receiving such requests required to respond to them individually, regardless of merit? If so, it seems blasting a few thousand requests at a small company would be a fairly simple act of sabotage. Even if the requests are fake, it would take the company time to figure out that they don't have any relevant records and to figure out whether to respond and how to respond.
The right can only be enforced against a "controller," which is the entity that "determines the purposes and means of the processing of personal data."
It's worth noting that GDPR does not give the data subject the right to request everything in the letter. Only a more limited set of things.
The practical effect for SaaS companies is that they should keep track of data and the systems and services where data is processed. With good preparation and a system of record for security/privacy management data, you can prepare for this kind of request very well. My company does just that - helps others prepare.
