The individual whose personal data is being collected, stored, used, or otherwise processed by an organization.
The data subject is the person the data is about — not the organization that holds it. In privacy law, data subjects have rights: the right to know what data is held about them, the right to access it, the right to correct inaccuracies, and in some jurisdictions, the right to have it deleted.
The term "data subject" is used in European privacy law (GDPR) and is increasingly used in Canadian privacy discussions. Under PIPEDA, the equivalent concept is the "individual" whose personal information is being handled.
Example: When you fill out a form to apply for a library card, you become a data subject. The library collects your name, address, and contact information. As a data subject, you have the right to request a copy of your record and to ask for corrections if any information is wrong.
Understanding the concept of data subjects is important for anyone designing systems that collect personal information, as it grounds privacy obligations in the real people affected by data practices.