Logo RGPD
RGPD.click
/
  1. Home
  2. Resources
  3. Fiches
  4. Right to Data Portability (Art. 20)
Courses Guides Blog Resources News
Français English Nederlands
Fiche 37/54 Part 4 — Data Subject Rights Advanced Reviewed 2026-08-23

Right to Data Portability (Art. 20)

Article 20 allows individuals to receive personal data they provided to a controller in a structured, commonly used and machine-readable format, and transmit it to another controller. This right opera

Open in interactive reader
⚖️ Digital Interoperability 📋 Cumulative Criteria (Art. 20)

Right to Data Portability (Art. 20)

⚡ In 30 seconds

Under Article 20, data subjects have the right to receive personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and transmit that data to another controller without hindrance, where processing is based on consent or contract and carried out by automated means.

Cumulative Condition Statutory Scope Covered / Excluded
1. Data 'Provided' Data actively given (forms) or observed through service usage (raw logs, sensor data). Covered: Playlists, purchase history, telemetry.
Excluded: Proprietary algorithmic scores, inferred profiles.
2. Legal Basis Strictly confined to Consent (Art. 6.1.a) or Contract (Art. 6.1.b). Excluded: Processing based on legal obligation or legitimate interests.
3. Automated Means Digital database systems and electronic services. Excluded: Paper records and non-automated files.
⚡ Key Takeaways
  • Direct transmission: data subjects have the right to have data transmitted directly between controllers where technically feasible.
  • Portability does not automatically trigger erasure; the initial service may continue until an Art. 17 request is filed.
  • Third-party rights: portability must not adversely affect the rights and freedoms of others (Art. 20.4).
⚠️ Common Pitfall

Providing a locked PDF scan of printouts; Article 20 expressly demands machine-readable structured formats (JSON, CSV, XML).

🛠️ In Practice

Build a secure self-service data export portal generating structured .json archives within the user profile.

⚖️ Official Sources: Art. 20 GDPR · Recital 68 · WP29 Guidelines on Data Portability (WP242) ✓ Legal review: 23 August 2026

✓ Key takeaways

  • Applies strictly to personal data provided directly by the data subject.
  • The processing must be based on consent (Art. 6.1.a) or contract performance (Art. 6.1.b).
  • Processing must be carried out by automated means (paper archives are excluded).

⚠ Common pitfall: Transmitting derived, inferred, or proprietary profiling scores under portability; only formally 'provided' data is covered.

→ Actionable practice: Develop an automated export tool delivering standard CSV, JSON, or XML formats encompassing user profile and raw activity records.

← Right to Restriction of Processing (Art. 18) Right to Object & Direct Marketing (Art. 21) →