Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 20
Right to data portability
Chapter 3|Rights of Data Subjects|📖 4 min read
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
(b) the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
Understanding This Article
Article 20 introduces data portability, a unique right that empowers data subjects to move their data between services, promoting competition and user control in the digital economy. This right recognizes that personal data about individuals belongs to them, not service providers.
Paragraph 1 establishes the core right with two key conditions:
Legal basis requirement: Processing must be based on consent (Article 6(1)(a) or 9(2)(a)) or contract (Article 6(1)(b)). This excludes data processed on other legal bases like legitimate interests or legal obligations.
Automated processing: Must be carried out by automated means (excludes paper records).
The data must be provided in a structured, commonly used, and machine-readable format - typically JSON, XML, or CSV formats that another system can easily import. This isn't just a PDF or printout.
Paragraph 2 goes further: data subjects can request direct transmission from one controller to another, where technically feasible. This reduces friction in switching services.
Paragraph 3 clarifies two limitations:
Portability doesn't override erasure rights (Article 17)
Doesn't apply to public interest or official authority processing
Paragraph 4 protects third parties: portability requests can't violate others' rights (e.g., can't port emails that contain others' personal data without considering their rights).
Key Points
Right to receive personal data in structured, machine-readable format
Only applies when processing based on consent or contract, and carried out by automated means
Data subject can request direct transmission to another controller when technically feasible
Doesn't apply to public interest tasks or official authority processing
Must not adversely affect others' rights and freedoms
Practical Application
Example 1 - Social Media Switching:
A user wants to switch from one social network to another. They request their profile data, posts, photos, and connections in JSON format. The current platform must provide this data, and if technically feasible, transmit it directly to the new platform. This reduces lock-in and promotes competition.
Example 2 - Bank Account Data:
A customer switching banks requests their transaction history, standing orders, and direct debit information in a machine-readable format. The old bank must provide this if the relationship was contractual (Article 6(1)(b)) and processing was automated.
Example 3 - Fitness Tracker Data:
A person using a fitness app based on consent wants to switch to a competitor. They request all their workout data, health metrics, and progress information in CSV format. The original app must provide it and, if possible, transmit it directly to the new app.
Example 4 - What's NOT Portable:
An employer processes employee data based on legal obligations and legitimate interests, not consent or contract. Portability rights don't apply. Similarly, a tax authority processing data for public interest tasks doesn't need to provide portable data.
Example 5 - Third Party Protection:
A user requests portability of all their emails. However, those emails contain personal data about correspondents. The controller must balance the portability right against the correspondents' privacy rights, potentially redacting third-party data.
Implementation Guidance:
Develop export functionality for commonly requested data types
Use standard formats: JSON, XML, CSV
Include data schema documentation
Consider API-to-API direct transmission capabilities
Distinguish between data provided by user vs. inferred/derived data (only "provided" data is portable)
Document technical feasibility of direct transmission
Assess impact on third parties before providing data
Set up processes to handle portability requests within one month
Industry Examples:
Google Takeout: Allows users to export all their data across Google services
Open Banking (EU): Banks must provide account data in portable formats
Music streaming: Export playlists and listening history
Email providers: Export emails in standard formats (MBOX, EML)