What is a Data Subject? All Details and Examples

Update: August 2026

As data privacy laws continue to evolve, understanding your role as a data subject matters more than most people realise. Whether you’re a consumer, employee, or online user, your personal data is being collected, stored, and sometimes shared. But what exactly does it mean to be a data subject, and what rights do you have?

What Is a Data Subject?

A data subject is any individual whose personal data is being collected, processed, or stored. This could include names, email addresses, ID numbers, IP addresses, biometric data, and more. Under regulations like the General Data Protection Regulation (GDPR), the data subject is the individual to whom the data refers.

If you use a service, shop online, apply for a job, or even browse the web, you’re likely a data subject.

What Rights Do You Have as a Data Subject Under GDPR?

The GDPR grants data subjects several powerful rights aimed at giving individuals control over their personal data. These include:

• Right to Access: You have the right to request that a company disclose the data it holds about you.

• Right to Rectification: You have the right to request corrections to inaccurate or outdated data.

• Right to Erasure (Right to Be Forgotten): You can request your data to be deleted.

• Right to Restrict Processing: You have the right to limit the use of your data.

• Right to Data Portability: You have the right to receive your data in a structured format and transfer it to another service.

• Right to Object: You can object to your data being used for specific purposes, like marketing.

• Right Not to Be Subject to Automated Decision-Making: You’re entitled to human intervention in automated decisions (e.g., credit scoring).

What Are Some Real-Life Examples of a Data Subject?

To make it more tangible, here are a few real-world examples:

• Online Shopper: You buy something on an e-commerce site and provide your name, address, and payment details. That makes you a data subject.

• Employee: Your employer stores your salary, contact, and performance data. That makes you a data subject too.

• Social Media User: Your posts, photos, and interactions are processed by platforms; again, you’re the data subject.

In all these cases, your personal information is being handled by someone else, and that gives you legal rights under data protection laws.

Why Do Data Subject Rights Matter?

As AI, big data, and surveillance technologies advance, so do the risks of misuse, breaches, and exploitation of personal data. Data subject rights protect personal autonomy, prevent discrimination, and hold companies accountable for how they use that data.

Targeted ads and algorithmic decisions about credit or job eligibility both run on personal data. Individuals need to understand how their data is being used, and be able to push back if it’s misused.

How Do You Submit a Data Subject Access Request (DSAR)?

If you want to know what data an organisation holds on you, you can file a Data Subject Access Request (DSAR). Here’s how:

1. Identify the Controller: Find out which company or organisation controls your data.

2. Draft Your Request: Clearly state that you are requesting access to your personal data under GDPR.

3. Verify Your Identity: Companies may request proof to confirm your identity.

4. Send It: Submit the request via email or through a dedicated form, if available.

5. Wait for a Response: Organisations typically have 1 month to respond.

No need to cite the law in complex terms; a clear, polite email usually suffices.

Frequently Asked Questions

Is every person a data subject?

Almost everyone is a data subject. If any organisation holds your personal data, you’re one.

Can I submit a DSAR to any company?

Yes, as long as the company falls under the scope of GDPR or similar data protection laws and processes your personal data.

Do companies always have to comply with my requests?

Not always. There are exceptions, such as when data is required for legal or public interest purposes. But they must explain why they’re refusing.

Is there a fee for submitting a Data Subject Access Request (DSAR)?

Generally no. However, if your request is excessive or repetitive, a company may charge a reasonable fee.