GDPR Q14

What is data portability under GDPR?

Q14. What is data portability under GDPR?

Category: Rights

Data portability lets people obtain and reuse their personal data across different services.

In simple terms

Applies when processing is based on consent or contract and carried out by automated means.
Provide the data in a structured, commonly used, machine-readable format.
Transfer directly to another controller when technically possible.

Scope of the right

Portability covers personal data the individual provided, including information they gave actively (like a form) and observed data (like activity logs). It does not include inferred data or trade secrets.

If the request concerns paper records only, portability does not apply.
You can offer portability for additional data voluntarily to improve service.
Check that sharing the data does not adversely affect others’ rights.

Delivering the data

Provide the data within one month, using formats like CSV, JSON, or XML. Explain the structure so the individual or new provider can understand it.

Ensure the file is secure and protected during transfer.
Authenticate the requester before releasing any data.
If direct transfer is requested, work with the new provider to make it happen.

Relationship with other rights

Portability complements but does not replace the right of access or erasure. Respond to each request on its own merits and explain if any data cannot be included.

If data also contains third-party information, seek consent or provide only the requester’s data.
Keep a record of the transfer for accountability.
If you refuse, explain the reasons and inform the person of their right to complain.

Practical steps to take

Confirm the processing meets the consent or contract criteria.
Validate the requester’s identity and clarify the scope.
Export the relevant data in a machine-readable format and review for accuracy.
Transfer securely or provide a download link with appropriate protection.
Document the process and timing in your request log.

Real-life examples

Switching energy supplier

A customer asks their energy provider for usage history. The company supplies a CSV file and offers to send it directly to the new supplier.

Moving fitness data

A runner wants to export workout records to a different app. The platform provides a JSON export within a week.

Helpful reminders

Portability does not cover data processed under legal obligation or public task.
Keep your export formats up to date and well documented.
Ensure the transfer process respects security requirements.
Coordinate with IT teams to automate exports where possible.

Key takeaway

Make it easy for people to move their data—portability supports innovation and shows you respect user choice.

Article references

Article 20 – Right to data portability