Data subject

A data subject is the natural person to whom personal data relate. The person may be a customer, employee, applicant, supplier contact, shareholder or website user. What matters is that information can be linked to an identified or identifiable natural person, not the person’s contractual relationship with the organisation.

The link may be direct or indirect. Identification does not require a name. A customer number, device identifier, location data, photograph or combination of details may make a person identifiable. Pseudonymised data remain personal data where additional information can be used to attribute them to a person. Information falls outside the concept only once it has been anonymised so that the person is no longer identifiable.

A data subject is not the same as the business processing the data. A legal entity is not a data subject in its own right. Information about a managing director, sole trader or another natural person may nevertheless be personal data. The data subject may have rights under the GDPR, including transparent information, access, rectification, erasure and restriction of processing. The data subject rights and access section explains how a request is handled.

For a business, the assessment starts with the actual processing activity: which groups of people are involved, which data are used and what makes a person identifiable? That classification supports decisions on transparency, access controls, retention and responsibility. The label “customer data” alone does not replace a precise assessment of the people concerned.