Data portability

The right to data portability under Article 20 GDPR gives data subjects, under specific conditions, the possibility to receive personal data concerning them and transmit it to another controller. It covers data the person provided to a controller where the processing is based on consent or a contract and is carried out by automated means.

The data must be provided in a structured, commonly used and machine-readable format. Where technically feasible, the data subject may also request direct transmission from one controller to another. The right is not a general claim to receive all business records. It does not affect the right to erasure and must not adversely affect the rights and freedoms of other people.

For businesses, this means clearly assigning the request, carrying out an appropriate identity check, identifying the data covered and producing a technically usable file. Personal data relating to other people and data that do not meet the conditions of Article 20 GDPR require particular care. The data subject rights and access topic places data portability within the wider handling of data subject requests. Related terms include the right of access, consent and legal basis.