Data subject
The natural person whose personal data is processed.
How the laws define this
Every cited law agrees that a data subject is a natural person or individual whose personal data or information is processed, and who receives statutory rights such as access and correction. The primary divergence concerns personhood boundaries and identification criteria. The Personal Data Protection (Amendment) Act 2024 explicitly clarifies that the term excludes deceased persons, whereas the remaining texts leave post-mortem status unaddressed. Furthermore, the Data Protection Act, 2012 (Act 843) requires that the individual can be identified directly or indirectly through the data, while the Protection of Personal Information Act (POPIA), No. 4 of 2013 frames the subject as the holder of rights and target of statutory obligations. Express rights also vary; for example, the Personal Data Protection (Amendment) Act 2024 includes breach notification, whereas the Personal Data Protection Proclamation No. 1321/2024 and Personal Data Protection Act B.E. 2562 (2019) explicitly highlight data portability.
Synthesised from the 8 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Ethiopia | Personal Data Protection Proclamation No. 1321/2024 | In Force | Explicitly lists data subject rights such as access, rectification, erasure, portability, and objection to processing. |
| Senegal | Law No. 2008-12 on the Protection of Personal Data | In Force | Lists specific rights including access, rectification, opposition, and in specified cases removal or erasure. |
| Thailand | Personal Data Protection Act B.E. 2562 (2019) | In Force | Explicitly enumerates rights like being informed, access, rectification, erasure, objection, withdrawal of consent, restriction, and portability. |
| Malaysia | Personal Data Protection Act 2010 (PDPA) | In Force (Amended) | Frames data subject rights within the Notice and Access principles and ties them to data user/controller or processor activities. |
| South Africa | Protection of Personal Information Act (POPIA), No. 4 of 2013 | In Force | Emphasizes that the data subject holds rights like access, correction, and deletion, and is the target of the Act's obligations. |
| Ghana | Data Protection Act, 2012 (Act 843) | In Force | Limits the term to an individual identifiable directly or indirectly through the personal data. |
| Iceland | Act on Data Protection and the Processing of Personal Data No. 77/2018 | In Force | Specifies rights granted under the Act, such as access and erasure. |
| Malaysia | Personal Data Protection (Amendment) Act 2024 | In Force | Clarifies exclusion of deceased persons and adds rights like data portability and breach notification. |
Definitions (8)
The individual whose personal data is the subject of processing activities under the Proclamation and who is thereby afforded rights such as access, rectification, erasure, portability, and objection to processing.
The natural person whose personal data are processed; the law grants data subjects specific rights such as access, rectification, opposition and, in specified cases, removal or erasure of their data.
The natural person whose personal data is processed; the PDPA grants data subjects explicit rights such as the right to be informed, access, rectification, erasure, objection, withdrawal of consent, restriction of processing, and data portability where applicable.
A natural person whose personal data is being processed by a data user/controller or data processor and who is entitled to exercise rights under the Act such as access, correction and, where applicable, consent-related protections. The Act frames duties to inform and enable these rights under the Notice and Access principles.
An individual whose personal data is processed; the Amendment clarifies that the term excludes deceased persons. Data subjects are granted rights under the Act, including the new statutory right to data portability and notification rights in the event of significant breaches.
A natural person whose personal information is processed; the holder of rights under POPIA (for example access, correction and deletion) and the person to whom obligations and protections in the Act are directed.
An individual who is the subject of personal data and can be identified directly or indirectly through that data.
The individual whose personal data is being processed and who is granted specific rights under the Act, such as access and erasure.
Not to be confused with
Information subject is a broader or alternative phrasing for the individual whose personal data is processed, without specifying rights or exclusions.
Data concerning a natural person refers to the data itself relating to an identified or identifiable person, not the person as the subject.
Questions and answers
What rights do data subjects have under these laws?
Rights vary by jurisdiction but commonly include access, rectification, erasure, objection, and portability; some like Thailand's PDPA and Ethiopia's Proclamation list them explicitly.
Does data subject include deceased persons?
Malaysia's Amendment Act 2024 explicitly excludes deceased persons from the definition of data subject.
How is a data subject identified?
Ghana's Act limits it to an individual identifiable directly or indirectly through the personal data.
Related Terms
information subject
The individual whose personal data is processed....
Data concerning a natural person (Personal data)
Any information relating to an identified or identifiable person....
Data concerning a natural person
Personal data relating to an identified or identifiable person....
Digital Personal Data
Personal data about an identifiable individual in digital form....
Sensitive personal data
Personal data warranting enhanced protections....