A data subject is the individual a piece of personal data belongs to or describes. In privacy law and security programs, this means the person behind an email address, account profile, identifier, log entry, or other information that can be linked to them. The term matters because rights, duties, and risks are judged from the person’s perspective, not just the database’s.
In cyber security, data subjects are central to breach response, access control, and data governance. Attackers often target data subjects through phishing, credential theft, and account takeover to reach their records or abuse their identities. Defenders use the concept to map which people are affected by an incident, limit collection to what is necessary, protect sensitive fields, and notify the right individuals when personal data is exposed.