Data subject

What it means

In GDPR terms a data subject is any living natural person whose personal data is processed. In a company these are employees and former employees, job applicants, customers, contact persons at suppliers and customers, website visitors or people captured by CCTV. A legal entity is not a data subject.

The GDPR gives data subjects a set of rights: to be informed about processing, the right of access, to rectification, to erasure, to restriction of processing, to data portability, to object and not to be subject to a decision based solely on automated processing.

The rights are not absolute. A company does not have to erase data it must keep by law, such as payroll records or accounting documents, and need not comply with a manifestly unfounded or repetitive request. It must, however, always assess the request and respond.

How it works in practice

As controller, a company must answer a data subject’s request without undue delay and at the latest within one month, extendable by two further months in complex cases, of which the requester must be told. We recommend a simple procedure setting out who receives requests and who handles them.

Before releasing data, the requester’s identity must be verified so the data does not reach the wrong person. When a former employee asks for a copy of their personnel file, for example, their own data is released, but not internal assessments of other people or the company’s trade secrets.

The foundation is the duty to inform: data subjects must know who processes their data, for what purpose, on what legal basis and for how long. For employees this is handled with information at onboarding, for customers with the privacy notice on the website.

What to watch out for

The most common mistake is ignoring a request because it arrived as an ordinary email or through social media. A request has no prescribed form and the deadline runs from receipt. An unanswered request is a frequent reason for complaints to the Office for Personal Data Protection.

The second mistake is releasing more than requested, such as an entire email thread containing other people’s personal data. That too breaches the GDPR. For sensitive requests, third parties’ data is best anonymised or redacted.