Table of Contents
Article 20 of GDPR: Data portability
Article 20 of GDPR sets the stage for data portability.
Data portability is a person’s ability to collect his or her personal information from one company and provide it to another company for the continuation of services or other services.
Data portability right exercised by a person (Article 20(1) GDPR)
A person can request that a company provide him or her the content of personal data processed and in the company’s possession as follows:
- In a structured way
- In a commonly used format
- In a machine-readable format
This allows the person to meaningfully obtain a copy of his or her personal data so they can provide it to another company of their choosing.
The individual can also ask the company to transmit their personal data directly to another company.
The data portability right can be exercised in the following two scenarios:
- When the company’s data processing was based on the consent received by the person (Article 20(1)(a) GDPR)
- When the data processing is being carried out through automated means (Article 20(1)(b) GDPR)
Data transmission to another company (Article 20(2) GDPR)
Data portability right further allows a person to request that a company, when technically possible, provide their personal data directly to another company.
Data portability not to affect the right to erasure (Article 20(3) GDPR)
GDPR makes it clear that the portability right must not affect a person’s right to be forgotten or data erasure.
Data portability not to affect the rights of others (Article 20(4) GDPR)
In the exercise of data portability rights, the rights and freedoms of others should not be affected.
Recitals applicable to Article 20 of GDPR
Relevant Recitals: 68
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 20 or relevant recitals
None
GDPR Text: Article 20 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
