Article 20 GDPR : Exercising the Right to Data Portability
Article 20 GDPR grants data subjects the right to receive their provided personal data in a structured, commonly used and machine-readable format (JSON, XML, CSV) and have them transmitted directly to another controller without hindrance for processing based on consent or contract.
Scope and Statutory Conditions of Data Portability (Art. 20(1) GDPR)
The right to data portability (EDPB/WP29 Guidelines WP242) aims to strengthen individuals' control over their personal data and foster competition between service providers by preventing vendor lock-in. It applies exclusively when two cumulative conditions are met:
- The processing is based on consent (Art. 6(1)(a) or Art. 9(2)(a)) or on the performance of a contract (Art. 6(1)(b));
- The processing is carried out by automated means.
The right does not apply to processing necessary for compliance with a legal obligation or the performance of a task carried out in the public interest.
Format Requirements and Direct Transmission (Art. 20(2) GDPR)
Personal data must be delivered in an open, structured, commonly used and machine-readable format.
Where technically feasible, the data subject has the statutory right to have the personal data transmitted directly from one controller to another without hindrance from the original controller.
Verified Official Sources
General Data Protection Regulation — EU Reference Legal Framework
Consult official source →Portabilité des données (Art. 20), format structuré, couramment utilisé et lisible par machine
Consult official source →See Also in the Legal Framework
Article 15 GDPR : Modalities of the Right of Access and Delivery of Data Copy
Legal framework of Article 15 GDPR and EDPB Guidelines 01/2022: scope of access rights, free first copy of data, specifi...
Article 17 GDPR : The Right to Erasure and Lawful Exceptions
Conditions for applying Article 17 GDPR: 6 legitimate grounds for erasure, 5 statutory exceptions (freedom of expression...