Under the GDPR, a data subject is the term used for a person whose personal information is held by someone, and that personal information can be used to identify the person (the data subject).