Data Subject
A data subject is the identified or identifiable living individual to whom personal data relates, giving that person rights over how their information is collected, used, retained, and disposed of.
Data subject is the privacy-law term for the natural person whose personal data appears in a record. The individual is “identifiable” when they can be singled out directly (by name) or indirectly (by an identifier, location data, or a combination of attributes). Because records that contain personal data are also records of and about a data subject, recordkeeping and privacy obligations overlap and must be reconciled.
This matters for records management because data subjects often hold rights that interact with the lifecycle: access to their data, correction, and in some regimes erasure or restriction. A retention schedule must therefore balance the legal or business reason to keep a record against a data subject’s interest in not having their data held longer than necessary, and disposition should be documented to show data was destroyed at the proper time.
For example, a personnel file describes an employee (the data subject) but is also a business record with its own retention period; a litigation hold can lawfully suspend an erasure request. Distinguish the data subject (the person) from the data controller or custodian (who manages the record).