Data subject

A data subject is the person at the centre of a personal-data record or activity. The term helps distinguish the individual from the organisations using or handling their information.

A person does not need to be named in a record to be a data subject. If they can be identified directly or indirectly from the information and available context, the information may relate to them. One activity can involve several categories of data subjects, such as customers, employees, emergency contacts and people appearing in security footage.

Individuals can be data subjects in their personal, professional and public lives. A company director is a data subject where information concerns them as an identifiable individual. An employee is a data subject in an HR system. A sole trader’s business contact details may also relate to them personally.

An organisation itself is generally not a data subject, although records about an organisation may contain information about identifiable people. This distinction should be checked under the applicable law rather than assumed from the document title.

Privacy frameworks commonly give data subjects rights to receive information about processing, access their data, correct inaccuracies and raise concerns. Other rights—such as objection, deletion, restriction, portability or protection in automated decision-making—vary in wording, scope and exceptions.

A rights request does not need legal terminology. “Please send me the information you hold about me” may be an access request even if the person never says “data subject”. Staff should know how to recognise and route such requests.

Children and people who cannot exercise rights personally may be represented by a parent, guardian or other authorised person under the relevant rules. Identity and authority should be verified proportionately without collecting excessive new information.

A school uses a learning platform. Pupils are data subjects because their names, work, progress and activity are recorded. Parents may also be data subjects where the platform holds their contact details. Teachers are data subjects in relation to their accounts and usage logs. The school should map each group rather than describing everyone simply as “users”.

Additional principles will be added during editorial review.

Describe data-subject categories in processing records, notices, impact assessments and incident plans. Provide accessible contact routes. Record requests and deadlines, verify identity proportionately, search relevant systems and explain any lawful refusal or limitation. Design information for the real audience.

Related terms: personal data; identifiable person; controller; privacy notice; data-subject rights; child; consent