Key References:
- GDPR Art. 4(1)
- Recitals 14, 27
An indirect definition:
- GDPR does not define data subject directly or explicitly
- However, Art. 4(1) definition of personal data states that, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)“
Recital 14:
- “The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.” [Emphasis Added]
Recital 27:
- “This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.”
Data subject under the GDPR is:
- an identified or identifiable natural person,
- not a legal person,
- not a deceased person.
