Right to Data Portability
A data subject's right to receive their personal data in a structured, machine-readable format and to transfer it to another controller.
Full Definition
The Right to Data Portability (Article 20 GDPR) gives individuals the right to receive personal data they have provided to a controller in a structured, commonly used, machine-readable format, and to transmit that data to another controller. This right applies only where processing is based on consent or contract performance, and carried out by automated means. The goal is to empower individuals to switch between services and reuse their data. In practice, this requires organisations to have export capabilities and defined data formats. The CCPA's right to know overlaps partially, and India's DPDP Act includes a related right to access data in a digital format.
How each law treats it
The data subject has the right to receive the personal data they have provided, in a structured, commonly used, machine-readable format, and to transmit it to another controller.
The DPDP Act does not currently provide a data portability right. Portability may be added by Rules in the future.
Consumers have the right to receive specific pieces of personal information in a portable and, to the extent technically feasible, readily usable format.
In practice
- Scope the right to data the subject provided — through consent or contract. Data derived by the controller (profiles, scores) is not in scope.
- Delivery format: CSV or JSON are safe defaults. Where the data was given in a specific format (photos, documents), return it in the same format.
- Direct transmission to another controller where technically feasible — large social networks typically offer this; small controllers often fall back to a downloadable archive.
Common pitfalls
- Scoping portability to 'all data about the subject'. The right is narrower — only data provided by the subject, under consent or contract.
- Treating portability and access as the same workflow. The scope and format requirements differ.
- Not thinking about third-party data embedded in the subject's data. Chat logs with other users need careful handling.
Frequently asked questions
What data is in portability scope?+
Data the subject provided themselves (profile fields, uploads, messages) processed by consent or contract. Derived data (recommendation scores, inferred interests) is not in scope.
What format must I deliver?+
Structured, commonly used, machine-readable. CSV and JSON meet the bar for most data. The EDPB guidelines mention XML. The point is the data must be re-importable elsewhere.
Do I have to transmit to another controller?+
Where technically feasible, yes. There is no obligation to build custom integrations; providing a downloadable archive that another controller can import is usually sufficient.
Related terms
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
DSAR
Data Subject Access Request — a formal request from an individual to access the personal data an organisation holds about them.
Data Subject
An identified or identifiable natural person whose personal data is being processed.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes