The categories of data subjects most organizations work with are workforce members, consumers and customers, marketing leads, specially protected groups (children, students, patients, and people whose biometric or other sensitive data is held), and third-party business contacts. Under the GDPR, a data subject is any identifiable living person linked to data such as a name, identification number, location data, or online identifier.1GDPR-info.eu. Art 4 GDPR – Definitions The category a person falls into determines which consent rules, retention periods, and security duties apply to their records, and federal U.S. laws add heightened protections on top of that baseline for children, students, and patients.
What Makes Someone a Data Subject
A data subject is any living individual who can be identified from the data an organization holds. The GDPR defines this broadly: a name, ID number, location ping, cookie identifier, or a combination of physical or economic characteristics that points back to a specific person all qualify.1GDPR-info.eu. Art 4 GDPR – Definitions U.S. state privacy laws use similar definitions, generally covering any information that identifies, relates to, or could reasonably be linked to a particular consumer or household.
What separates one category from another is the relationship between the person and the organization holding the data. An employee’s payroll file triggers different obligations than a website visitor’s cookie data. Getting the classification right drives everything downstream: how long records can be kept, who inside the organization can access them, and what rights the individual can exercise.
Workforce Data Subjects
Workforce data subjects include anyone with a professional or contractual tie to an organization: current employees, former staff whose tax or pension records remain on file, retirees, job applicants from the moment they submit a resume, and independent contractors whose details sit in payroll or management systems.
The data involved is among the most sensitive an organization holds. Social Security numbers, bank routing details for direct deposit, performance reviews, disciplinary records, and background check results all live in this category. Federal rules set specific retention periods for much of it. Form I-9 records, for example, must be kept for three years after the date of hire or one year after employment ends, whichever comes later.2U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 Mishandling any of it exposes the employer to liability under both labor laws and data privacy frameworks.
Workplace monitoring adds another layer. Employers increasingly track keystrokes, email activity, GPS locations on company devices, and time-management metrics. Those records create personal data about workforce subjects even when the monitoring’s stated purpose is productivity or security, and they should be treated with the same care as other workforce records.
Consumer and Customer Data Subjects
Consumer and customer data subjects are individuals who have completed a purchase, opened an account, or entered a subscription. The defining feature is a transactional relationship: these people handed over personal information to receive goods or services. Former customers who cancelled still qualify as long as their records remain on file.
Organizations typically hold purchase histories, billing addresses, payment card details, loyalty program profiles, and account preferences for this group. Privacy laws require businesses to tell these customers how their financial data is shared with payment processors and other partners. Accurate records also matter for resolving billing disputes and honoring warranty obligations under consumer protection statutes. When a customer account goes inactive, the organization still bears responsibility for securing that data until it is properly deleted or the retention period expires.
Marketing and Lead Data Subjects
Marketing and lead data subjects sit at the opposite end of the relationship spectrum from customers. They have shown interest in a brand without committing to a purchase. This group includes people who fill out a web form, sign up for a newsletter, download a whitepaper, or simply browse a website that drops tracking cookies on their device.
The data collected here is heavily behavioral: IP addresses, pages visited, ads clicked, time spent on site, and geolocation inferred from a device. Names and email addresses enter the picture when someone opts into a mailing list. Under the CAN-SPAM Act, every commercial email must include a clear way to opt out, and the sender has to honor that request within 10 business days.3Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business Ignoring an opt-out request is one of the fastest ways to draw an enforcement action.
Browser-level privacy signals matter here too. The Global Privacy Control signal, which a user enables once in browser settings, automatically tells every website they visit not to sell or share their data. Several state privacy laws now require businesses to treat that signal as a legally valid opt-out request, so organizations relying on targeted advertising or third-party data sharing need systems that can detect and honor these automated signals in real time.
Specially Protected Groups
Some data subjects receive heightened legal protection either because of who they are or because of the type of data involved. Penalties for mishandling their information run higher.
Children
Under the federal Children’s Online Privacy Protection Act, a child is anyone under the age of 13.4eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule Before collecting any personal information from a child, a website or online service must obtain verifiable parental consent, and the parent must have the option to allow data collection for internal use while blocking disclosure to third parties.5eCFR. 16 CFR 312.5 – Parental Consent Violations can result in civil penalties of up to $53,088 per incident.6Federal Trade Commission. Complying with COPPA Frequently Asked Questions The GDPR sets its own threshold at 16 for consent to online services, though individual EU member states can lower it to as young as 13.
Students
The Family Educational Rights and Privacy Act protects education records at any school that receives federal funding. Parents have the right to inspect their child’s records and challenge inaccurate content, and schools generally cannot release personally identifiable information from those records without written parental consent.7Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights Education records include grades, transcripts, class schedules, student financial information, health records at the K-12 level, and discipline files.8Protecting Student Privacy. What Is an Education Record Schools may respond to a parent’s access request within 45 days, and exceptions for disclosure without consent are narrow, covering situations like transfers between schools, audits by authorized officials, and certain law enforcement needs.
Patients
Protected health information held by healthcare providers, insurers, and their business associates falls under HIPAA. The restrictions on who can access medical records and how they can be shared are among the strictest in U.S. law. When a breach of unsecured health information occurs, the covered entity must notify affected individuals no later than 60 calendar days after discovering the breach.9eCFR. 45 CFR 164.404 – Notification to Individuals Regulators track that deadline closely and publish a public list of breaches affecting 500 or more people.
People Whose Biometric or Other Sensitive Data Is Held
Biometric identifiers like fingerprints, facial geometry, iris scans, and voiceprints occupy a unique position in privacy law. Unlike a password, you cannot change your fingerprint after a breach. The GDPR classifies biometric data used for identification as a special category that is generally prohibited from processing unless a specific legal basis applies, alongside data revealing racial origin, political opinions, religious beliefs, trade union membership, genetic information, health status, or sexual orientation. Several U.S. states have enacted standalone biometric privacy statutes that require written consent before collection, a stated purpose for the data, a defined retention schedule, and a plan for permanent destruction. Private lawsuits in this area have produced some of the largest privacy settlements in recent years.
Third-Party and Business Contact Data Subjects
Third-party and business contact data subjects are individuals who represent another organization in a business-to-business relationship. The vendor’s account manager, the supplier’s logistics coordinator, the corporate client’s procurement lead: their names, phone numbers, and work email addresses all count as personal data under modern privacy definitions, even though they shared those details in a professional capacity.
Data collection for this group should stay limited to what is genuinely necessary for maintaining the business relationship, typically contract signatures, communication logs, and professional credentials. Privacy frameworks treat this information with the same baseline protections as consumer data, which means contact lists cannot be sold or shared outside the purpose for which they were collected. When an organization shares this data with a vendor or processor, a written data processing agreement should spell out access limits, confidentiality obligations, breach notification duties, and rules for bringing in subcontractors.
Rights That Follow Every Category
Regardless of which category a data subject falls into, a consistent set of rights follows them. The GDPR grants rights spanning access, correction, erasure, restriction of processing, data portability, and the right to object to certain types of processing.10GDPR-info.eu. Chapter 3 – Rights of the Data Subject U.S. state privacy laws have adopted many of these same rights, though the exact scope varies by jurisdiction.
The right to access means you can ask any organization what personal data it holds about you and receive a copy. The right to correction lets you fix inaccurate records. The right to erasure allows you to request deletion, though an organization can deny it when the data is needed to comply with a legal obligation, complete a transaction you initiated, detect fraud, or defend a legal claim.11GDPR-info.eu. Art 17 GDPR – Right to Erasure Data portability lets you request your personal data in a structured, machine-readable format and transmit it directly to another service provider, and it applies when the processing was based on your consent or a contract and was carried out by automated systems.12GDPR-info.eu. Art 20 GDPR – Right to Data Portability
Response deadlines run tight. Under the GDPR, an organization must respond to a rights request within one calendar month of receipt, with a possible two-month extension for complex or high-volume situations, provided the person is notified of the delay within that first month.13GDPR-info.eu. Art 12 GDPR – Transparent Information, Communication and Modalities Most U.S. state privacy laws set a 45-day response window with the option of an additional 45-day extension upon notice.
Why the Categories Matter at Breach Time
Categorizing data subjects pays off most visibly during a breach. Notification obligations differ depending on what type of data was exposed and who it belongs to. Health data breaches involving unsecured protected health information trigger a hard 60-day notification deadline to affected individuals under federal law.9eCFR. 45 CFR 164.404 – Notification to Individuals Most state breach notification laws require notice within 30 to 60 days, though the specific window and what counts as a triggering breach varies.
An organization that has already sorted its data subjects into clear categories can identify quickly who needs to be notified, what type of data was compromised, and which regulatory framework governs the response. One that treats all personal data as a single undifferentiated pool will spend the first critical days after a breach just working out what it lost, and that delay compresses every subsequent deadline.