Data Subject
An identified or identifiable individual whose personal data is being collected or processed.
A data subject is any living individual whose personal data is being processed by an organization. Under the GDPR, a data subject is defined as an identified or identifiable natural person — someone who can be identified directly (by name, ID number) or indirectly (by IP address, cookie identifier, location data, or other factors specific to their physical, genetic, mental, economic, cultural, or social identity). Website visitors become data subjects the moment any personal data, including IP addresses or device identifiers, is collected.
Data subjects have extensive rights under the GDPR and similar privacy laws. These include the right to access their data, rectify inaccuracies, request erasure, restrict processing, data portability, object to processing, and not be subject to solely automated decision-making. Organizations must provide clear mechanisms for data subjects to exercise these rights and respond within statutory timeframes — typically one month under the GDPR. Failing to respect data subject rights is a frequent basis for regulatory complaints and enforcement actions.