Rights & Ethics

Data subject

The natural person whose personal data is processed.

How the laws define this

Every cited law agrees that a data subject is a natural person or individual whose personal data or information is processed, and who receives statutory rights such as access and correction. The primary divergence concerns personhood boundaries and identification criteria. The Personal Data Protection (Amendment) Act 2024 explicitly clarifies that the term excludes deceased persons, whereas the remaining texts leave post-mortem status unaddressed. Furthermore, the Data Protection Act, 2012 (Act 843) requires that the individual can be identified directly or indirectly through the data, while the Protection of Personal Information Act (POPIA), No. 4 of 2013 frames the subject as the holder of rights and target of statutory obligations. Express rights also vary; for example, the Personal Data Protection (Amendment) Act 2024 includes breach notification, whereas the Personal Data Protection Proclamation No. 1321/2024 and Personal Data Protection Act B.E. 2562 (2019) explicitly highlight data portability.

Synthesised from the 8 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

JurisdictionInstrumentStatusWhat is distinctive
EthiopiaPersonal Data Protection Proclamation No. 1321/2024In ForceExplicitly lists data subject rights such as access, rectification, erasure, portability, and objection to processing.
SenegalLaw No. 2008-12 on the Protection of Personal DataIn ForceLists specific rights including access, rectification, opposition, and in specified cases removal or erasure.
ThailandPersonal Data Protection Act B.E. 2562 (2019)In ForceExplicitly enumerates rights like being informed, access, rectification, erasure, objection, withdrawal of consent, restriction, and portability.
MalaysiaPersonal Data Protection Act 2010 (PDPA)In Force (Amended)Frames data subject rights within the Notice and Access principles and ties them to data user/controller or processor activities.
South AfricaProtection of Personal Information Act (POPIA), No. 4 of 2013In ForceEmphasizes that the data subject holds rights like access, correction, and deletion, and is the target of the Act's obligations.
GhanaData Protection Act, 2012 (Act 843)In ForceLimits the term to an individual identifiable directly or indirectly through the personal data.
IcelandAct on Data Protection and the Processing of Personal Data No. 77/2018In ForceSpecifies rights granted under the Act, such as access and erasure.
MalaysiaPersonal Data Protection (Amendment) Act 2024In ForceClarifies exclusion of deceased persons and adds rights like data portability and breach notification.

Definitions (8)

The individual whose personal data is the subject of processing activities under the Proclamation and who is thereby afforded rights such as access, rectification, erasure, portability, and objection to processing.

The natural person whose personal data are processed; the law grants data subjects specific rights such as access, rectification, opposition and, in specified cases, removal or erasure of their data.

The natural person whose personal data is processed; the PDPA grants data subjects explicit rights such as the right to be informed, access, rectification, erasure, objection, withdrawal of consent, restriction of processing, and data portability where applicable.

A natural person whose personal data is being processed by a data user/controller or data processor and who is entitled to exercise rights under the Act such as access, correction and, where applicable, consent-related protections. The Act frames duties to inform and enable these rights under the Notice and Access principles.

An individual whose personal data is processed; the Amendment clarifies that the term excludes deceased persons. Data subjects are granted rights under the Act, including the new statutory right to data portability and notification rights in the event of significant breaches.

A natural person whose personal information is processed; the holder of rights under POPIA (for example access, correction and deletion) and the person to whom obligations and protections in the Act are directed.

An individual who is the subject of personal data and can be identified directly or indirectly through that data.

The individual whose personal data is being processed and who is granted specific rights under the Act, such as access and erasure.

Not to be confused with

information subject

Information subject is a broader or alternative phrasing for the individual whose personal data is processed, without specifying rights or exclusions.

Data concerning a natural person

Data concerning a natural person refers to the data itself relating to an identified or identifiable person, not the person as the subject.

Questions and answers

What rights do data subjects have under these laws?

Rights vary by jurisdiction but commonly include access, rectification, erasure, objection, and portability; some like Thailand's PDPA and Ethiopia's Proclamation list them explicitly.

Does data subject include deceased persons?

Malaysia's Amendment Act 2024 explicitly excludes deceased persons from the definition of data subject.

How is a data subject identified?

Ghana's Act limits it to an individual identifiable directly or indirectly through the personal data.