What is a data subject?

The natural person to whom the personal data refers and who exercises the rights provided for in the LGPD (Brazilian General Data Protection Law).

Definition

The data subject is the natural person to whom the personal data being processed refers, such as a client, employee, patient, student, or website user.

The data subject is always a natural person. Companies are not data subjects, although the people who work for them are. Every privacy program exists to protect the rights of that person.

What does the LGPD say?

Article 5, V, of LGPD It provides the definition. Article 17 guarantees every natural person ownership of their personal data, and Article 18 lists the rights: confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, information about the possibility of not consenting, and revocation of consent. Article 19 establishes response deadlines, and Article 20 guarantees the review of automated decisions.

In practice

  • Provide a clear channel for requests, such as a privacy portal or an email address for the data protection officer.
  • Authenticate the applicant before handing over any data.
  • Respond within the deadline: immediately in simplified format or within 15 days with a complete statement.
  • Record each request and each response as evidence.

How Privacy Tools it deals with the topic

O Privacy Portal receives requests from the holders and the Management of Holders' Requests It authenticates, distributes, monitors deadlines, and keeps a record of each transaction. DSAR.

Related terms

DSAR · Personal data · Controller · Consent · Back to glossary

Updated .

Want to see this concept applied in practice?

Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.

Platform screen Privacy ToolsList of treatment activities in Data Mapping