What is a data subject?
A data subject is the identified or identifiable individual to whom personal data relates. A person can be identified directly through information such as a name or customer number, or indirectly through combinations of location, device data, online activity, characteristics or other identifiers.
The concept is broad and depends on context. Information may relate to a person even when it does not name them, and the person does not need to be the customer who provided the data. Employees, applicants, users, visitors, patients, suppliers and members of the public can all be data subjects.
Why is the data-subject concept important?
Privacy law is designed to protect people rather than records. Identifying the relevant groups helps an organisation assess expectations, vulnerability, possible harm and the rights that may apply. It also ensures that notices and support channels are designed for the correct audience.
A single processing activity can involve several categories of data subjects. A workplace platform may process employee, candidate, manager, emergency-contact and customer information, each with different context and risks.
How does an organisation identify data subjects?
Data mapping and records of processing should describe the groups of people represented in each activity. Teams should examine direct collection, data received from vendors, inferred information and records about third parties. Free-text fields and communications may contain personal data about people who were not expected.
Identifiability should be considered using all means reasonably available to the organisation or likely recipients. A coded record may still relate to a person when a key or other linking data exists.
What rights can a data subject have?
Rights vary by law but can include access, deletion, correction, portability, restriction, objection, withdrawal of consent and protections relating to automated decisions. The organisation should provide understandable information and accessible routes for exercising applicable rights.
Rights are not always absolute. Identity verification, legal exceptions and the rights of other people may affect the response, but decisions should be documented and communicated appropriately.
Frequently asked questions
Is a business contact a data subject?
Yes. A person’s professional email, role and communications can be personal data even when used in a business context.
Can a deceased person be a data subject?
Rules vary. The GDPR generally protects living individuals, while national laws or confidentiality duties may protect deceased persons’ information.
Is an anonymous user a data subject?
They may be identifiable through cookies, device identifiers, account links or other information. The practical ability to identify them matters.
Can one record relate to several data subjects?
Yes. Emails, family records, case files and communications often contain information about multiple people.
Does a data subject own personal data?
Privacy law generally provides rights and protections rather than simple property ownership. Organisations may hold records while still owing duties to the person.