What is a data subject?
Definition
A data subject is the identified or identifiable living person that personal data is about. Under UK GDPR and the EU GDPR, that's you whenever an organization holds information that can be linked to you.
- Category
- Privacy
- Also called
- data subjects
- Last updated
"Data subject" is the legal name for the person whose personal data is being collected, used or stored. The ICO, the UK data protection regulator, describes it as the identified or identifiable living individual that personal data relates to. The UK GDPR doesn't define the term on its own: it appears in the definition of personal data (Article 4(1)), as the person the data concerns.
Two limits matter. First, only living people count, so data protection law doesn't apply to the data of someone who has died. Second, you are a data subject only if you can be identified, directly or indirectly, from the data. A name and address clearly qualify. So can an online identifier, or a mix of details that point to one person.
In practice, you are a data subject all the time: a customer of a shop, an employee, a patient, a person listed on a people-search site. Whoever decides why and how your data is used is the data controller. The law gives data subjects rights over their data, and the ICO's guidance explains them.
The term is mostly used in Europe and the UK. US privacy laws use other words, such as "consumer" in California.
Data subject vs. data controller
The data subject is the person the data is about. The controller is the organization that decides how it's used. You are the first, the company is the second.
How to protect yourself
- 1
Find out who holds your data
Ask an organization what it holds about you. UK and EU organizations must respond to these requests, and the ICO explains how.
- 2
Read the privacy notice before you sign up
It should say what data is collected, why and who it's shared with. If it doesn't, think twice.
- 3
Share the minimum
Leave optional fields blank and use a separate email for sign-ups you don't trust.
- 4
Ask for deletion where you can
You can ask companies and data brokers to delete your data. Serus finds the sources that hold your information and sends removal requests for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data subject the same as a customer?
No. A customer is a role. A data subject is any living person the data is about, whether customer, employee, visitor or someone listed in a database.
Does a dead person count as a data subject?
No. The ICO says the term covers living individuals only.
Do companies have to call me a data subject?
Not necessarily. It's the legal term used in the UK GDPR and EU GDPR, but the notices you see may just say "you".
Sources
Something wrong or out of date? Tell us and we'll re-check it.