A data subject is the natural person that personal data relates to — see Identified or identifiable person for when a person counts as identifiable in this sense. As a stakeholder, the data subject wishes to protect their own personal data as an Asset, even though they typically do not own or operate the systems that process it.

Data subjects can be employees, customers, or any other person whose data the organisation processes. Where the data processed is , the Data Protection Officer (DPO) acts as their point of contact and is responsible for upholding their statutory rights (access, correction, deletion, etc.). A Risk to a data subject's information is treated with particular care, since the harm falls on someone outside the organisation who usually has little visibility into, or control over, the controls protecting them.