According to the GDPR, the data subject is the natural person to whom the personal data relate. These are typically EU residents whose rights are protected by the Regulation. The data subject is not a legal person. Personal data can only be in relation to an existing natural person, as the General Regulation excludes its application to data on deceased persons.