Article 20 GDPR - Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
(b) the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

Relevant Recitals

Frequently Asked Questions

Short answers to common questions about this provision. They are general information and not legal advice.

Under paragraph 1 the data subject may receive the personal data concerning him or her which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and may transmit those data to another controller without hindrance. Paragraph 2 adds a right to have the data transmitted directly between controllers where technically feasible.

Two cumulative conditions must be met. The processing must be based on consent under point (a) of Article 6(1) or point (a) of Article 9(2), or on a contract under point (b) of Article 6(1), and it must be carried out by automated means. Processing resting on other legal bases, such as legitimate interests or a legal obligation, falls outside the right.

The text covers personal data concerning the data subject which he or she has provided to the controller. It plainly includes data actively supplied, and Recital 68 confirms the focus on data the data subject provided, but the extent to which observed data generated by the data subject's use of a service are included is not settled by the text itself, whereas data derived or inferred by the controller sit outside the wording.

No. Paragraph 3 states that the right is without prejudice to Article 17, so transmission does not by itself oblige the original controller to delete anything. The data subject who also wants erasure must invoke Article 17 separately, and its own conditions and exceptions then apply.

Yes. The second sentence of paragraph 3 excludes processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and paragraph 4 provides that the right shall not adversely affect the rights and freedoms of others, which matters where a dataset also contains third parties' personal data.