What is a Data Subject?
As data privacy laws continue to evolve, understanding your role as a data subject has never been more important. Whether you’re a consumer, employee, or online user, your personal data is being collected, stored, and sometimes shared. But what exactly does it mean to be a data subject, and what rights do you have?
What Is a Data Subject?
A data subject is any individual whose personal data is being collected, processed, or stored. This could include names, email addresses, ID numbers, IP addresses, biometric data, and more. Under regulations like the General Data Protection Regulation (GDPR), the data subject is the individual to whom the data refers and is at the centre of modern data protection laws.
Simply put, if you use a service, shop online, apply for a job, or even browse the web, you’re likely a data subject.
Your Rights as a Data Subject Under GDPR
The GDPR grants data subjects several powerful rights aimed at giving individuals control over their personal data. These include:
• Right to Access – You have the right to request that a company disclose the data it holds about you.
• Right to Rectification – You have the right to request corrections to inaccurate or outdated data.
• Right to Erasure (Right to Be Forgotten) – You can request your data to be deleted.
• Right to Restrict Processing – You have the right to limit the use of your data.
• Right to Data Portability – You have the right to receive your data in a structured format and transfer it to another service.
• Right to Object – You can object to your data being used for specific purposes, like marketing.
• Right Not to Be Subject to Automated Decision-Making – You’re entitled to human intervention in automated decisions (e.g., credit scoring).
Examples of a Data Subject in Real Life
To make it more tangible, here are a few real-world examples:
• Online Shopper: You buy something on an e-commerce site and provide your name, address, and payment details – you’re a data subject.
• Employee: Your employer stores your salary, contact, and performance data – you’re a data subject.
• Social Media User: Your posts, photos, and interactions are processed by platforms; again, you’re the data subject.
In all these cases, your personal information is being handled by someone else, and that gives you legal rights under data protection laws.
Why Data Subject Rights Matter in 2025
As AI, big data, and surveillance technologies advance, so do the risks of misuse, breaches, and exploitation of personal data. In 2025, data subject rights are more than legal entitlements – they’re tools for protecting personal autonomy, preventing discrimination, and holding companies accountable.
From targeted ads to algorithmic decisions about credit or job eligibility, individuals need to understand how their data is being used and be able to push back if it’s misused.
How to Submit a Data Subject Access Request (DSAR)
If you want to know what data an organisation holds on you, you can file a Data Subject Access Request (DSAR). Here’s how:
1. Identify the Controller: Find out which company or organisation controls your data.
2. Draft Your Request: Clearly state that you are requesting access to your personal data under GDPR.
3. Verify Your Identity: Companies may request proof to confirm your identity.
4. Send It: Submit the request via email or through a dedicated form, if available.
5. Wait for a Response: Organisations typically have 1 month to respond.
No need to cite the law in complex terms; a clear, polite email usually suffices.
FAQs About Data Subjects
Is every person a data subject?
Almost everyone is a data subject in today’s digital world, if any organisation holds your personal data, you’re one.
Can I submit a DSAR to any company?
Yes, as long as the company falls under the scope of GDPR or similar data protection laws and processes your personal data.
Do companies always have to comply with my requests?
Not always. There are exceptions, such as when data is required for legal or public interest purposes. But they must explain why they’re refusing.
Is there a fee for submitting a Data Subject Access Request (DSAR)?
Generally no. However, if your request is excessive or repetitive, a company may charge a reasonable fee.