GDPR Q46
What is the right to data portability?
Q46. What is the right to data portability?
Category: Rights
The right to data portability lets individuals receive their personal data in a usable format and move it to another provider.
In simple terms
- Applies to data provided by the individual, processed by automated means, under consent or contract.
- Provide data in a structured, commonly used, machine-readable format.
- Transfer directly to another controller where technically feasible.
Scope and limits
Portability covers data provided by the individual, including observed data like usage history. It does not cover derived or inferred data.
- Respond within one month, extendable by two months for complex cases.
- Ensure transfers respect other individuals’ rights.
- Offer explanations of data formats if needed.
Delivery methods
Provide secure downloads, encrypted files, or direct transfers. Verify identity before releasing data.
- Use secure channels such as password-protected files or portals.
- Log transfers to demonstrate compliance.
- Notify individuals if you cannot facilitate a direct transfer and explain why.
Practical steps to take
- Set up procedures for receiving and authenticating portability requests.
- Identify systems holding relevant data and how to export it.
- Prepare scripts or tools to format data consistently.
- Send data securely or arrange direct transfer with the new provider.
- Record actions taken and confirm completion with the requester.
Real-life examples
Bank account switch
A bank provides a secure export of transaction history and sends it directly to the customer’s new bank.
Fitness app
A fitness app offers a JSON download of workout data and uploads it to another app on request.
Helpful reminders
- Portability is separate from the right of access—handle each request appropriately.
- If data includes third-party information, consider redaction or consent.
- Document reasons if you refuse a request and inform the individual of their right to complain.
Key takeaway
Support portability with clear procedures and secure transfers—it empowers users and demonstrates trustworthiness.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.