Executing Data Portability Requests

Overview

The right to data portability under GDPR Article 20 allows data subjects to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. This skill provides the complete workflow for assessing scope, extracting data, formatting output, and facilitating direct transfers.

Legal Foundation

GDPR Article 20 — Right to Data Portability

1. Art. 20(1) — The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

   • (a) the processing is based on consent under Art. 6(1)(a) or Art. 9(2)(a), or on a contract under Art. 6(1)(b); AND
   • (b) the processing is carried out by automated means.

2. Art. 20(2) — The data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. Art. 20(3) — The exercise of portability shall not adversely affect the rights and freedoms of others.

4. Art. 20(4) — The right to portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.