The data subject is the identified or identifiable natural person to whom personal data relates.
Who is a data subject?
Data subjects can be customers, employees, job applicants, suppliers, website visitors or any other natural person. Nationality and place of residence are irrelevant.
Legal persons such as a limited company are not data subjects. Deceased persons are not protected by the GDPR either, although Member States may lay down their own rules for them.
Rights of the data subject
The GDPR grants data subjects extensive rights, including the rights to information, access, rectification, erasure, restriction of processing, data portability and objection. In addition, there is the right to lodge a complaint with the supervisory authority and the right to compensation.
Requests must generally be answered within one month.
Legal provisions
- Art. 4(1) GDPR
- Defines personal data and the data subject.
- Arts. 12 to 22 GDPR
- Rights of the data subject.
- Arts. 77 and 82 GDPR
- Right to lodge a complaint and right to compensation.
Related terms.
Right of access The right of access entitles every person to obtain confirmation from a controller as to whether, and which, personal data concerning them is being processed. Art. 15 GDPR Right to object The right to object allows data subjects to object to processing of their data that is based on legitimate interests or on a task carried out in the public interest. Art. 21(1) GDPR 