A call-centre staffer asks who the “data subject” is when a CRM row concerns a deceased relative. Which GDPR-focused answer is correct?
Select an answer to reveal the explanation.
Short Explanation
GDPR’s spotlight is on living people. A deceased relative is generally outside that GDPR “data subject” frame, though national law might still say something about the dead. The living customer in the next field is the classic data subject.
Full Explanation
Under the GDPR, a data subject is the identified or identifiable natural person to whom personal data relates; the Regulation focuses on living natural persons, while Member State law may address deceased persons separately. Call-centre staff should not treat a CRM row about a deceased relative as creating GDPR Chapter III rights for the deceased as primary data subject under the Regulation. Recital 27 clarifies the GDPR focus on living persons. Only companies and public authorities are not the data subjects—natural persons are. Data-subject status does not attach only to supervisory authority staff. Exam caveat: deceased-persons items test Recital 27 plus possible national rules—not full GDPR Chapter III for the deceased as default. Operational check: train CRM teams to flag deceased-status workflows under national law and still protect living relatives’ personal data that appears in the same record. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.