A data subject is any living individual whose personal data is collected or processed by an organization. Under GDPR Article 4(1), this includes website visitors, customers, and app users — anyone a site tracks via cookie identifiers or IP addresses. GDPR grants data subjects eight enforceable rights: to be informed, access their data, correct it, request erasure, restrict processing, data portability, object to processing, and rights against automated decision-making. Data controllers must respond to requests exercising these rights within 30 days, and cookie consent systems must honor users' withdrawal choices in real time.