Data Subject

What is a data subject?

A data subject is the person that personal data is about. The GDPR's Article 4(1) defines personal data as information relating to an "identified or identifiable natural person", and calls that person the data subject. "Natural person" means a human being, not a company.

A few points follow from the text:

• People, not companies: Recital 14 says the GDPR does not cover data about legal persons, such as a company's name and legal form. The people who work there are data subjects.
• The living: Recital 27 says the GDPR does not apply to the personal data of deceased persons, though EU countries may set their own rules.
• Any nationality: Recital 14 says protection applies whatever a person's nationality or place of residence. For a company outside the EU, Article 3(2) covers data subjects "who are in the Union" when it offers them goods or services or monitors their behavior there.
• Identifiable is enough: a person does not need to be named. An online identifier or location data can be enough to identify someone.

In a SaaS company, data subjects include your users, your customers' employees, your own staff, job applicants and anyone who fills in a form on your site. Your vendors hold data about all of them.

US law uses other words. The CCPA speaks of a "consumer", meaning a natural person who is a California resident. See CCPA and CPRA.

What rights a data subject has

Chapter 3 of the GDPR sets out the rights of the data subject. The main ones are in Articles 15 to 22:

• Access to their data (Article 15). See data subject access request.
• Correction (Article 16) and erasure (Article 17).
• Restriction of processing (Article 18) and data portability (Article 20).
• Objection to processing (Article 21) and limits on automated decisions (Article 22).

Under Article 12(3), you must answer within one month of receiving a request. You can extend that by two further months for complex or numerous requests, if you tell the person within the first month and say why. In the UK, the ICO says that since the Data (Use and Access) Act 2025 you only need to make reasonable and proportionate searches when someone asks for their data.

Where vendors come in

A request usually comes to you, the company the person knows, even when the data sits with a vendor. Two rules connect the two:

• Article 28(3)(e) requires your contract with each processor to say it will help you respond to requests from data subjects.
• Article 19 requires you to pass any correction, erasure or restriction on to each recipient of the data, unless that is impossible or involves disproportionate effort.

So a deletion request does not stop at your own database. Your DPA with each vendor lists the categories of data subjects it handles, in the description of processing.

A real change we caught

Venpo flagged that Klaviyo no longer promises to pass privacy requests on to you. When a person sends a request to a vendor instead of to you, a promise like this is how you find out about it.

Why it matters to you

The one-month clock runs from when you receive the request, and the answer is yours to give, including the parts that depend on a vendor. If a vendor is slow to search or delete, you can miss the deadline. If a vendor gets a request and does not pass it on, you may not know it exists.

What to check

• Assistance clause: that each vendor's DPA still promises help with data subject requests, and says how fast.
• Forwarding: whether the vendor promises to pass on requests it receives directly, or only to tell the person to contact you.
• Self-service tools: whether you can find, export and delete one person's data in the vendor's admin settings, or must open a ticket.
• Categories of data subjects: that the DPA's list matches what you actually send the vendor, such as end users, your customers' staff or your own employees.
• Deletion reach: whether deletion also covers backups and the vendor's subprocessors. See backup retention.

How Venpo helps

Data subject rights depend on vendor promises that can change, such as the promise to help with requests or pass them on. Venpo watches your vendors' DPAs, privacy policies and other public legal pages and emails you a plain-English alert when such a promise changes. The change history, with a redline of each change, shows what each vendor promised when a request came in.