Andmesubjekt

Andmesubjekt is a term used in certain legal and data protection contexts, particularly within the European Union. It refers to an identifiable natural person whose personal data is being processed. The concept is central to data privacy regulations, most notably the General Data Protection Regulation (GDPR).

Under the GDPR, an andmesubjekt has specific rights concerning their personal data. These rights include the right to access their data, the right to rectification, the right to erasure (also known as the right to be forgotten), the right to restrict processing, the right to data portability, and the right to object to processing. Data controllers and processors are obligated to respect these rights and ensure that personal data is processed lawfully, fairly, and transparently.

The definition of "identifiable" is key. A person is considered identifiable if they can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. This broad interpretation means that even seemingly anonymous data can be considered personal data if it can be linked back to an individual. Understanding the role of the andmesubjekt is fundamental to comprehending data protection principles and obligations.