Data subject

The data subject is the person in the record

A data subject is the living person to whom personal data relates. In employment records, that person might be an employee, worker, candidate, former colleague, referee, emergency contact, dependant, manager, complainant or witness.

The term describes the person's relationship to particular information. It is not another word for employee, and a company or software account is not a data subject. The ICO's definitions for small organisations explain that the person can be identified directly or indirectly.

One record can concern several people

A document does not always have one data subject. A grievance note can contain information about the person raising the concern, the person complained about, witnesses and the manager taking notes. Each person has interests and rights in the information about them.

That matters when deciding what to disclose, correct or restrict. Answering one person's subject access request does not mean handing over every unredacted sentence. You may need to separate their information from personal data about others and make a careful, recorded decision about disclosure.

Make rights easy to exercise

Data subjects have rights including being informed, access, rectification, erasure, restriction, portability and objection, plus protections relating to significant decisions made solely by automated processing. Those rights are not unconditional. The lawful basis, processing and any applicable restriction or exemption affect the response.

Give people accessible privacy information and one clear contact for questions or requests. Train anyone receiving a request to recognise it even when it arrives verbally and uses no legal phrase. Check identity only where necessary and proportionately, keep records searchable and log the reasoning and response. A simple route is more reliable than expecting every person to know data-protection terminology.