What is a data subject?
A data subject is the person that personal data is about. The term comes from the EU General Data Protection Regulation (GDPR), which defines personal data as information relating to an identified or identifiable natural person and calls that person the data subject. A customer in a retailer's database, an employee in an HR system, a patient in a clinic's records and a visitor tracked by a website cookie are all data subjects. Other privacy laws use their own words for the same idea; California's privacy law, for example, calls them consumers.
Who counts as a data subject
- Identifiable, not just named: a person counts if they can be identified directly or indirectly, for example from an account number, device identifier, IP address, location history or a combination of details.
- Living individuals: GDPR protects natural persons, not companies, and it does not cover people who have died, although some countries add their own rules.
- Location, not nationality: a company outside the EU that offers goods or services to people in the EU, or monitors their behavior there, must treat them as data subjects under GDPR whatever their citizenship.
- Pseudonymized data still counts: replacing names with tokens doesn't end someone's status as a data subject if the data can be linked back to them. Truly anonymized data no longer relates to an identifiable person and falls outside GDPR.
Data subject rights
GDPR gives data subjects a set of rights that the controller, the organization deciding why and how their data is processed, must honor:
- Information: to be told what is collected, why, for how long and who receives it (Articles 13 and 14).
- Access: to get confirmation of processing and a copy of their data (Article 15).
- Rectification: to have inaccurate data corrected (Article 16).
- Erasure: the right to be forgotten, in defined situations (Article 17).
- Restriction: to have data kept but not used, for example while its accuracy is disputed (Article 18).
- Portability: to receive data they provided in a machine-readable format and move it elsewhere, where processing relies on consent or a contract and is automated (Article 20).
- Objection: to object to some processing, and to stop direct marketing outright (Article 21).
- Automated decisions: protection from decisions with legal or similarly significant effects made solely by automated processing (Article 22).
Handling a data subject request
Requests to use these rights are called data subject requests, or data subject access requests (DSARs) when someone asks for a copy of their data. The GDPR deadline is one month, which can stretch to three months in total when requests are complex or numerous, and the first copy of the data is normally free. The security team's main job is identity verification. An attacker who files an access request in a victim's name is trying to steal the data, so the controller confirms identity in proportion to the data's sensitivity, for example by having the person sign in to their existing account rather than trusting an email that only quotes an address. Each request, the checks made and the response are logged as evidence.
Data subject vs. controller, processor and data owner
The data subject is the person the data describes and the holder of the rights. The controller decides why and how the data is processed and answers to the data subject. A processor handles the data on the controller's instructions and helps the controller meet requests, but doesn't decide them. A common trap is confusing the data subject with the data owner: the owner is the manager inside the organization who is accountable for a data set, while the subject is the person the records are about.
Data subject on the CompTIA Security+ exam
On SY0-801 the data subject sits behind two objectives: 5.4, which covers privacy rights such as the right to be forgotten, data correction and processing restrictions as part of a compliance program, and 3.3, which covers the data roles of controller, processor and subprocessor. It usually shows up inside scenarios. "A customer asks for a copy of her data" or "a former user requests deletion" describes a data subject exercising a right, and the question usually asks which right applies or who must respond. The controller is the answer for who is responsible; the processor and the data owner are the usual distractors.