Glossary

Data subject

Data protection glossary · 6 minutes read

Under Article 4(1) GDPR, a data subject is an identified or identifiable natural person to whom personal data relate. The term therefore refers to the individual whose data are processed and to whom the General Data Protection Regulation (GDPR) grants specific rights. Whether a person qualifies as a data subject does not depend on whether they have consented to the processing or have a contractual relationship with the controller.

Data subjects are encountered by businesses and public authorities in many areas of everyday life.

Typical examples include:

Customers: Whose contact details, orders or payment information are processed.
Employees: Whose personnel, payroll or working time data are processed by an employer.
Applicants: Whose application documents and personal details are processed during the recruitment process.
Website users: Whose personal usage data or identifying technical identifiers are collected.
Patients: Whose health data are processed as part of medical treatment.

People who are not in direct contact with a business may also be data subjects. This may be the case, for example, where a business receives personal data from third parties or where individuals are captured by video surveillance.

The decisive factor is that the information being processed relates to the particular natural person.

When is a person identified or identifiable?

A person is identified if their identity is directly established, for example by linking information to their full name.

However, a person may also be a data subject even if their name is not directly known.

Under Article 4(1) GDPR, it is sufficient that they can be identified, directly or indirectly, by reference to additional information.

This may be possible, for example, through:

Customer numbers or employee numbers
Location data
Online identifiers
IP addresses under certain circumstances
Combinations of different personal characteristics

According to Recital 26 GDPR, the means reasonably likely to be used must be taken into account when assessing whether a person is identifiable.

In particular, the time and costs required, as well as the available technological capabilities, may be relevant.

A purely theoretical possibility of identification is not sufficient.

Can employees, children and other individuals also be data subjects?

The protection afforded by the GDPR is not limited to customers or consumers.

In principle, any living natural person may be a data subject if personal data relating to them are processed.

This includes, for example, employees, applicants, children, patients and business partners, provided they are natural persons.

Minors are also independent holders of data protection rights. The GDPR takes account of their particular need for protection, including in Recital 38.

Depending on their age, maturity and the applicable legal requirements, legal representatives may play a role in exercising their rights.

Legal persons, such as a limited liability company (GmbH) or a public limited company (AG), are not themselves data subjects within the meaning of the GDPR.

However, information about employees, managing directors or other natural persons in connection with a business may constitute personal data.

What rights do data subjects have?

The GDPR grants data subjects various rights that enable them to understand the processing of their personal data and, under certain circumstances, influence it.

These rights include, in particular:

Right of access (Article 15 GDPR): To obtain information about the processing of their personal data.
Right to rectification (Article 16 GDPR): To have inaccurate personal data rectified.
Right to erasure (Article 17 GDPR): To request the erasure of personal data under certain conditions.
Right to restriction of processing (Article 18 GDPR): To have processing restricted in cases provided for by law.
Right to data portability (Article 20 GDPR): To receive or have certain personal data transferred in an appropriate format.
Right to object (Article 21 GDPR): To object to processing under certain conditions.

Article 22 GDPR also contains specific provisions on decisions based solely on automated processing, including profiling.

In addition, under Article 77 GDPR, data subjects may lodge a complaint with a data protection supervisory authority if they consider that their personal data are being processed unlawfully.

Each of these rights is subject to its own statutory requirements and possible restrictions.

What is the difference between a data subject and a controller?

The data subject and the controller have different roles under data protection law.

The data subject is the individual to whom the personal data being processed relate.

Under Article 4(7) GDPR, the controller is generally the entity that determines, alone or jointly with others, the purposes and means of the processing.

For example, a customer whose order details are stored is the data subject. The online retailer that decides how those data are processed is the controller.

By contrast, under Article 4(8) GDPR, a processor processes personal data on behalf of a controller.

Depending on the processing context, a natural person may assume different roles under data protection law. For example, a self-employed business owner may be the controller in relation to their customers' data while also being a data subject in relation to their own data processed by another business.

This distinction is important because different rights and obligations arise from the respective roles.

Practical example: A customer as a data subject

A customer regularly orders products from an online retailer.

The business stores their name, address, email address and information about previous orders.

The customer is the data subject within the meaning of Article 4(1) GDPR because the stored information relates to them.

The online retailer is the controller insofar as it determines the purposes and means of the data processing.

Even if the customer has not expressly consented to the storage of individual items of information, they remain a data subject and may exercise their statutory data protection rights.

For example, they may request access to information about the processing of their personal data under Article 15 GDPR.

legal data assessment: For the purposes of data protection law, the decisive factor is which natural person the information being processed relates to. Businesses should therefore also assess whether personal data are involved in cases where individuals can be identified indirectly, and ensure that the corresponding data subject rights are observed. This applies regardless of whether there is direct customer contact or a contractual relationship.

Legal bases

Articles 4(1), 4(7) and 4(8), as well as Articles 12–22 and Article 77 GDPR; supplemented in particular by Recitals 26 and 38 GDPR.

Frequently asked questions about data subjects under the GDPR

What does the term “data subject” mean?

A data subject is an identified or identifiable individual to whom personal data relate. The term is used in Article 4(1) GDPR.

Are employees data subjects?

Yes. Employees are data subjects if their employer processes personal data relating to them. This includes, for example, personnel, payroll and working time data.

Can children be data subjects?

Yes. Children are also data subjects within the meaning of the GDPR. Their personal data are subject to data protection requirements. Legal representatives may play a role in exercising their rights.

Can businesses be data subjects?

No. Legal persons, such as a limited liability company (GmbH) or a public limited company (AG), are not themselves data subjects under the GDPR. However, information about natural persons within a business may constitute personal data.

Does a data subject have to consent to the processing of their data?

No. A person qualifies as a data subject regardless of whether they have consented to the processing of their personal data. The lawfulness of the processing is a separate legal question.