Data subject Definition

GLOSSARY

/ˈdeɪtə/ /ˈsʌbdʒɛkt/

Published by a UU��ֱ�� Commercial expert

What does Data subject mean?

Under the GDPR, an identified or identifiable natural person. The concept is key to determining what is personal data (ie information relating to a data subject) and which persons have rights under the GDPR.

An ‘identifiable natural person’ is a living person who can be identified, directly or indirectly, in particular by reference to an identifier (such name, identification number, location data and other examples set out in Article 4(1) of the GDPR).

A deceased person is not a data subject under the GDPR, although EEA states may make further rules regarding personal data of the deceased.

Commercial

View the related checklists about Data subject

Statutory claims that may be validly settled by a settlement agreement—checklist

Statutory claims that may be validly settled by a settlement agreement—checklist Most of the claims that may be brought in the employment tribunal derive from a jurisdiction created by statutory provisions. Each such set of statutory provisions will include a provision that prevents the parties (or potential parties) to an employment tribunal claim from reaching an agreement that purports to settle the claim and, in so doing, purports to have the effect of ousting the jurisdiction of the employment tribunal to adjudicate upon the dispute. These provisions are usually referred to as 'contracting-out provisions', and they appear in similar form in a wide variety of employment legislation, eg in the Employment Rights Act 1996 (ERA 1996), Trade Union and Labour Relations (Consolidation) Act 1992 (TULR(C)A 1992) and the Equality Act 2010 (EqA 2010). They are designed to protect claimants (or potential claimants) by preventing them from signing away their right to bring or pursue a claim without adequate safeguards having been observed. The basic rule is that any agreement reached...

Recruitment—best practice—checklist

Recruitment—best practice—checklist STOP PRESS: The Information Commissioner’s Office (ICO) has published draft guidance on keeping employment records and recruitment and selection which is open for consultation until 5 March 2024, and has also removed the employment practices code (first published in March 2022, and last updated in November 2011) and supplementary guidance from its employment information page. For more information, see Q&A: What is the status of the ICO employment practices code? and ICO removes employment practices code and related guidance from its Employment information guidance page, LNB News 15/12/2023 112. This Practice Note will be updated once the ICO draft guidance is finalised. This checklist provides a summary of the factors that an employer should consider before, and during, the recruitment process. It takes account of the Employment practices code (Code) issued by the Information Commissioner's Office (ICO) and the supplementary guidance to the Code, although these have not been updated to take account of Assimilated Regulation (EU) 2016/679, UK General Data...

EU GDPR—personal data breach notification—flowchart

EU GDPR—personal data breach notification—flowchart The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) is directly applicable and fully enforceable in EU and EEA states. This Flowchart focuses on personal data breach notification under the EU GDPR. It covers: • a summary of the overarching obligations • key guidance • types of personal data breaches • the flowchart of notification requirements • general examples of personal data breaches and who to notify • detailed examples of personal data breaches and who to notify The EU GDPR includes the following definition of a personal data breach: ‘…a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.’ Overarching obligations In summary, among other things, the EU GDPR provides that: • data processors must notify the data controller without undue delay after becoming aware of a personal data breach • unless the personal data breach is unlikely to result in a risk to the rights...

Handling data subject requests—flowchart

Handling data subject requests—flowchart The UK General Data Protection Regulation (UK GDPR) provides a number of rights for data subjects, including providing a right of access to their personal data, rights to rectification, erasure, restriction of processing and data portability, a right to object to processing and a right not to be subject to a decision based solely on automated decision making, including profiling. Data subjects can make a request to an organisation to exercise one or more of these rights at any time and there are strict time limits for complying with requests made. See Practice Note: How to handle data subject requests. This Flowchart maps out a process for handling data subject requests received under the UK GDPR. It reflects requirements in the UK GDPR together with guidance issued by the Information Commissioner’s Office (ICO). It should be read in conjunction with Practice Note: How to handle data subject requests and the following detailed Flowcharts for handling requests under specific data subject rights: • Evaluating a data subject...

Rights of data subjects under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.Changes as a result of the General Data Protection RegulationThe General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.For further information, see Practice Notes: Introduction to the EU GDPR and UK GDPR and Rights of data subjects.A data subject is a living individual who is the subject of personal data, ie data from which he can be identified. For key definitions under the DPA 1998, see Practice Note: Key definitions under the DPA 1998. For a comprehensive introduction to the GDPR, collating key practical guidance, see: Data protection toolkit.Right of access to personal dataAn individual has a right to be informed...

Key definitions under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.BackgroundThe DPA 1998 governs processing of personal data in the UK. It obliges processors of such data to comply with eight principles, and gives individuals a right to know what information is held about them. For further information on the principles, see Practice Note: Data protection principles under the DPA 1998.The Information Commissioner's Office (ICO) supervises and enforces the implementation of the DPA 1998. For more information, see Practice Notes: The Information Commissioner’s Office (ICO) and Sanctions and enforcement under the DPA 1998.Sections 1 and 2 of the DPA 1998 contain definitions for the key terms used throughout the act and within the Information Commissioner's codes of practice or other guidance. Key statutory definitions include:•Data•Personal data•Sensitive personal data•Data subject•Data controller•Data processor•Processing•Relevant filing systemChanges as a result of the General Data Protection...

Discover our 394 Practice Notes on Data subject

Response to data subject request—right to erasure—able to comply with request

Response to data subject request—right to erasure—able to comply with request [Name of individual making request] [Address of individual making request] [Date of this response] Dear [insert name of individual making request] I am writing in response to your request dated [insert date of request], which we received on [insert date]. [You have asked us to [confirm precisely what the data subject requested, eg ‘delete all personal data we hold about you’.].] I confirm that we have complied with your request and have deleted all personal data that we hold about you[ in our live systems. We also hold data in our backup systems and [insert details of what will happen to data in your backups if it is not being erased with the data in

Share purchase agreement—pro-buyer—corporate seller—conditional—long form

Share purchase agreement—pro-buyer—corporate seller—conditional—long form This Agreement is made on [insert day and month] 20[insert year] Parties 1 [Insert name of selling corporate entity] incorporated in [England and Wales OR [insert country of incorporation] OR with registered number [insert company number] whose registered office is at [insert address] (the Seller); 2 [Insert name of purchasing corporate entity] incorporated in England and Wales OR [insert country of incorporation] OR with registered number [insert company number] whose registered office is at [insert address] (the Buyer), and 3 [Insert name of guarantor entity] incorporated in England and Wales OR [insert country of incorporation]] with registered number [insert company number] whose registered office is at [insert address] (the Guarantor) [(each of the Seller, the Buyer and the Guarantor being a Party and together the Seller, the Buyer and the Guarantor are the Parties).] Background (A) The Company (as defined below) is a private company limited by shares and is incorporated in [England and...

Dive into our 211 Precedents related to Data subject

Can an insurer refuse to provide internal correspondence and case notes relating to an insurance claim where a subject access request (SAR) is made under the UK GDPR for such information?

Can an insurer refuse to provide internal correspondence and case notes relating to an insurance claim where a subject access request (SAR) is made under the UK GDPR for such information? This Q&A assumes that the organisation that has received the SAR is a ‘controller’ of the relevant data. For an introduction to the United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) regime, including key data protection terms and concepts, such as ‘personal data’, 'processing', 'data subject' and ‘controller’, see: Data protection toolkit. As further explained in Practice Notes: The UK GDPR and DPA 2018 for insurers and Data subject rights—access, Article 15 of the UK GDPR gives individuals a right to obtain confirmation from a data controller as to whether or not personal data concerning them is being processed, and where it is, access to the personal data and certain further information. A request for such information is commonly known as a ‘subject access request’ (or a 'SAR' or 'DSAR'). In order to assist...

Can my business record and share an online meeting, event or a lesson that we host?

Can my business record and share an online meeting, event or a lesson that we host? This Q&A is intended for commercial private-sector organisations in the UK. It provides guidance on whether you can record and share an online meeting, event or lesson hosted by your business in accordance with UK General Data Protection Regulation (GDPR), Assimilated Regulation (EU) 2016/679. It also explains the potentially lawful grounds for recording a meeting under the GDPR, what you need to do before recording, and whether you can post the recording online. What are the data protection obligations for recording? When you record video meetings, you are collecting personal data. Your organisation will be the data controller for the data collected in the recording, so you must comply with Article 5 of the GDPR by: • processing the data lawfully, fairly and in a transparent manner • collecting the data for a specified legitimate purpose only • limiting data collection to what is necessary for the purposes of processing • keeping the data...

See the 199 Q&As about Data subject

Employment weekly highlights—12 December 2024

This edition of Employment weekly highlights includes: (1) a webinar from Lexis+ UK Employment team member Cathy Hoar, and Stephen Ratcliffe of Baker & McKenzie looking at some of the most significant changes contained in the Employment Rights Bill, (2) analysis by Victoria Hordern of Taylor Wessing LLP of the Data (Use and Access) Bill, (3) a successful paternity leave sex discrimination employment tribunal claim, (4) notice that all employment tribunal online services (affecting submission of ET1s, ET3s and digital applications) will be temporarily unavailable between 18.00 and 23.00 on Monday 16 December 2024 due to a planned upgrade, (5) our new Practice Note providing a destination table showing how the Employment Tribunal Procedure Rules 2024 (ET Rules 2024), in force from 6 January 2025, correspond to the ET Rules 2013 which they replace, (6) our new Precedent comprising a set of clauses that may be inserted by a customer into a contract with a supplier to help the customer (as an employer) comply with its duty to prevent sexual...

A closer look at the Data (Use and Access) Bill of 2024

Information Law analysis: Victoria Hordern, partner at Taylor Wessing LLP, discusses the Data (Use and Access) Bill, how it differs from previous proposals, who will be impacted, and key takeaways for data protection and privacy practitioners.

Read the latest 695 News articles on Data subject

Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

Case studies

"It gives us a really broad coverage of the law, as well as the specialist areas we have to deal with: contracting, procurement, employment law, governance. I've found some fairly obscure case law on LexisLibrary, very quickly."

Walsall Council

Access all documents on Data subject

GET ACCESS NOW

Top

Trial

UU��ֱ��

GLOSSARY