Data Subject
An identified or identifiable natural person whose personal data is being processed.
Full Definition
Under GDPR and many privacy laws, a 'Data Subject' is the natural person whose personal data is being collected or processed. Data subjects have rights including the right to access their data, right to rectification, right to erasure ('right to be forgotten'), right to restriction of processing, right to data portability, and right to object. Organisations must have processes to respond to data subject rights requests within regulatory deadlines (30 days under GDPR, 45 days under CCPA, 72 hours under DPDP Act in some cases). India's DPDP Act uses the term 'Data Principal' for the same concept.
How each law treats it
An identified or identifiable natural person. Identifiability tests include direct identifiers, quasi-identifiers and the 'means reasonably likely to be used' test.
'Data Principal' is the DPDP equivalent.
'Titular dos dados' — the natural person to whom the data refers. Rights framework is close to the GDPR's.
In practice
- A legal person (company, trust, estate) is not a data subject. The GDPR applies only to natural persons.
- Children are data subjects. GDPR Article 8 adds the parental consent requirement for information-society services provided to children under 16 (member states can lower to 13).
- Deceased persons are usually out of scope under GDPR, but some member states extend protection — France, Italy and Austria have post-mortem rules.
Common pitfalls
- Assuming business-contact information falls outside the GDPR. It doesn't — the EDPB has repeatedly treated work emails and job titles as personal data when linked to an identifiable individual.
- Treating pseudonymised identifiers as 'anonymous' — the data subject behind a pseudonym is still a data subject.
- Overlooking indirect identifiers in supposedly anonymised exports; the K-anonymity test is the right instrument.
Frequently asked questions
Is a work email a data subject's personal data?+
Yes, where it identifies an individual. '[email protected]' is personal data; '[email protected]' is not. The EDPB has been consistent on this point.
Does the GDPR cover deceased persons?+
Not at the EU level. Some member states — notably France and Italy — have extended protection to the deceased or allow the deceased's family to exercise certain rights. Check national law for processing that spans death.
What about pseudonymised data?+
Still personal data under GDPR. Pseudonymisation reduces risk but does not remove data from scope. Only properly anonymised data falls outside the GDPR (Recital 26).
Related terms
Data Principal
The individual to whom personal data relates, as defined under India's DPDP Act (equivalent to 'data subject' under GDPR).
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Right to Erasure
An individual's right to have their personal data deleted ('right to be forgotten') in certain circumstances.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes