A data subject is the identified or identifiable natural person to whom personal data relates. In privacy and data protection law, most prominently the EU General Data Protection Regulation (GDPR), the data subject is the person whose information is collected, stored or analyzed, and the holder of the rights that the law grants, such as access, rectification, erasure and objection.
The concept is the anchor of privacy fundamentals. Personal data exists only because it relates to a data subject, the data controller and data processor carry obligations toward that person, and every privacy assessment ultimately asks how processing affects the data subject’s rights and freedoms.
Who counts as a data subject
A person is a data subject when they are identified, for example by name, or identifiable, meaning they can be singled out directly or indirectly by reference to an identifier such as an ID number, location data, an online identifier or factors specific to their physical, genetic, economic or social identity. Identifiability is judged by the means reasonably likely to be used, considering cost, time and available technology.
Under the GDPR, data subjects are living natural persons regardless of nationality or residence, provided the processing falls within the regulation’s scope. Companies and other legal persons are not data subjects, although data about their employees or sole traders can be personal data. Deceased persons fall outside the GDPR, but individual member states may protect them under national law.
| Context | Examples of data subjects | Typical data |
|---|---|---|
| E-commerce | Customers, newsletter subscribers, site visitors | Contact details, orders, cookies |
| Employment | Employees, applicants, contractors | Payroll, evaluations, access logs |
| Healthcare | Patients, study participants | Diagnoses, treatment records |
| Public services | Citizens, benefit recipients | Identity numbers, case files |
| Security monitoring | People recorded on camera | Video footage, timestamps |
Rights of the data subject
The GDPR gives data subjects a set of enforceable rights, mainly in Articles 12 to 22. Controllers must make these rights easy to exercise, respond without undue delay and within one month, extendable by two further months for complex or numerous requests, and generally act free of charge.
| Right | What the data subject can demand | Main limits |
|---|---|---|
| Information | Clear notice about purposes, legal basis, recipients and retention | Some exceptions for data not obtained from the person |
| Access | Confirmation of processing and a copy of the data | Rights of others must not be adversely affected |
| Rectification | Correction of inaccurate or incomplete data | Applies to factual data |
| Erasure | Deletion, often called the right to be forgotten | Legal obligations, freedom of expression, legal claims |
| Restriction | Temporary limit on processing during a dispute | Data may still be stored |
| Data portability | Data in a structured, machine-readable format | Only consent or contract, automated processing |
| Objection | Stop processing based on legitimate interests or for direct marketing | Absolute for direct marketing only |
| Automated decisions | Not to be subject to solely automated decisions with significant effects | Exceptions for contract, law or explicit consent |
Before answering a request, the controller must verify the requester’s identity in a proportionate way. Asking for excessive documents can itself breach data minimization, while too little verification risks disclosing data to an impostor.
Data subject compared with related privacy roles
Privacy law divides responsibilities among distinct roles, and confusing them leads to errors in contracts and notices. The data subject is the only role that holds rights rather than obligations.
| Role | Definition | Relationship to the data subject |
|---|---|---|
| Data subject | Person the data is about | Holds the rights |
| Data controller | Decides purposes and means of processing | Owes transparency and must honor rights |
| Data processor | Processes data on behalf of the controller | Assists the controller with requests |
| Third party or recipient | Receives data from the controller | Must be disclosed to the data subject |
| Supervisory authority | Public regulator | Receives complaints from data subjects |
Other legal systems use different terms for a similar idea. The CCPA in California speaks of the consumer, meaning a California resident, and sets a response period of 45 days, extendable once. Many laws modeled on the GDPR keep the term data subject or use individual or data principal.
Handling data subject requests in practice
Organizations that process personal data at scale need a repeatable process for data subject requests (DSRs), sometimes called data subject access requests (DSARs) when they concern access. The process depends on knowing where personal data lives across systems, which is why a current record of processing activities and data map are essential.
- Receive and log the request through any channel, since no special form may be required.
- Verify identity proportionately, using information already held where possible.
- Locate the data across databases, backups, email, support tools and processors.
- Assess exemptions, such as legal retention duties or the rights of other people.
- Respond within the deadline, explaining any refusal and the right to complain.
Teams should also consider special category data, such as health or biometric information, which requires extra care in both processing and responses, and children as data subjects, whose consent and rights are often exercised by parents.
Common misconceptions about data subjects
A widespread mistake is believing that pseudonymized data has no data subject. If the controller or another party can re-identify the person with additional information, the data remains personal and the person remains a data subject. Only truly anonymous data, where re-identification is not reasonably possible, falls outside the rules.
- Business contacts are data subjects too; a work email with a person’s name is personal data.
- Citizenship does not matter under the GDPR; scope depends on establishment and targeting.
- Rights are not absolute; erasure and objection can be refused on documented legal grounds.
- Consent is not the only basis for processing; rights apply whatever the legal basis.
The simple explanation
A data subject is simply the person that information is about. If a shop keeps your name, address and order history, you are the data subject of that information.
Privacy laws give you rights over that information: you can ask what is stored about you, get a copy, fix mistakes and in many cases ask for it to be deleted or for marketing to stop. Companies holding the data have to listen and answer within a set time.
How it is used in practice
A customer of an online furniture retailer in the European Union emails support asking for all personal data the company holds about her and for her marketing profile to be deleted. As the data subject, she does not need to use a special form or explain her reasons.
The privacy team logs the request, confirms her identity by matching the email address and a recent order number, and searches the shop database, the email marketing platform, the customer service tool and the delivery partner’s system. It removes her from marketing lists immediately, because objection to direct marketing is absolute, but keeps invoices that tax law requires to be retained.
Within three weeks she receives a copy of her data in a readable file and an explanation of what was deleted and why invoices remain, together with information about her right to complain to the supervisory authority.