What is GDPR data portability under Article 20?
GDPR data portability is the right to receive personal data that you have provided to a controller in a structured, commonly used and machine-readable format and to transmit it to another controller when Article 20 applies. That wording is the starting point for both exam questions and practical requests: the right is about reuse and transfer of qualifying data, not a general demand for a copy of every internal record.
The format requirement is explicit. An image-only export cannot satisfy the article’s machine-readable wording merely because it contains the same visible information. The provision does not prescribe one file extension; the answer must be assessed against the characteristics stated in Article 20(1).
How is GDPR data portability different from a subject access request?
A subject access request under Article 15 is the broader access right, while Article 20 portability adds conditions about the data provided, the legal basis, automated processing and machine-readable reuse. The two rights can be requested together, but they should not be treated as interchangeable.
| Question | Article 15 access | Article 20 portability |
|---|---|---|
| What does the cited text provide? | Confirmation, access to personal data and listed processing information. | Receipt of qualifying personal data and the right to transmit it. |
| Must the person have provided the data? | Article 15 is not limited by that phrase. | Article 20 expressly says data the person has provided. |
| Legal basis and processing mode | The Article 15 provision does not add Article 20’s two conditions. | Consent or contract, and processing by automated means. |
| Format in the provision | Article 15(3) does carry its own, weaker format rule: where the request is made by electronic means, and unless the data subject asks otherwise, the information shall be provided in a commonly used electronic form. It does not use Article 20’s machine-readable wording. | Structured, commonly used and machine-readable — in every case, not only when the request arrives electronically. |
The format row is the one exam candidates most often get wrong in the other direction: Article 15 is not silent on format. Its rule is conditional (it applies to requests made by electronic means and yields to a different wish of the data subject) and it asks only for a commonly used electronic form, so a PDF can satisfy Article 15(3) while failing Article 20(1). The difference is the strength of the requirement, not its presence.
For a deeper treatment of the broader right, see our guide on handling a GDPR subject access request; this page focuses on the additional portability test.
Which conditions must be met for portability?
Article 20 requires both a qualifying legal basis and automated processing: the processing must be based on consent under Article 6(1)(a) or Article 9(2)(a), or on a contract under Article 6(1)(b), and it must be carried out by automated means. These are cumulative conditions, so a request does not become portable just because the information is stored digitally.
- Data concerning the requester that they provided: start with the article’s own scope instead of assuming that every inferred, internal or third-party record belongs in the portability set.
- Consent or contract: identify the legal basis for the particular processing, not merely the organisation’s general privacy notice.
Can one controller send the data directly to another?
The requester has the right to direct controller-to-controller transmission where technically feasible, but Article 20 does not guarantee a universal connector or a successful import by the receiving service. A practical example is a person switching between two online services: the first controller may need to provide a machine-readable export, while direct transmission depends on a technically feasible path between both controllers.
Two limits remain important for exam candidates. Article 20(3) says the right does not apply to processing necessary for a task in the public interest or the exercise of official authority, and Article 20(4) protects the rights and freedoms of others. The right to portability also operates without prejudice to Article 17, so it is not a substitute for the separate right to erasure.
How was this guide checked?
GDPR Exam Trainer checked this guide by mapping each legal sentence to the English EUR-Lex text of Articles 15 and 20, then testing the scope against recurring practitioner questions. The responsible organisation for this editorial review is GDPR Exam Trainer; the method is transparent source mapping plus an independent build and citation gate. Its purpose is to help DPO certification candidates spot the access-versus-portability distinction, not to provide legal advice.
Frequently asked questions
These answers apply the Article 20 conditions and the Article 15 comparison to the practical questions raised by candidates and practitioners.
What is GDPR data portability?
GDPR data portability is the Article 20 right to receive personal data that you provided to a controller in a structured, commonly used and machine-readable format and to transmit it to another controller when the legal conditions are met.
Does data portability cover every piece of personal data a company holds?
No. Article 20 refers to personal data concerning you that you have provided to the controller. The broader right of access under Article 15 is a separate right and covers access to personal data plus the information listed in that article.
Can the first controller send my data directly to the next controller?
Yes, Article 20(2) gives you the right to have the data transmitted directly from one controller to another where technically feasible. The article does not promise that every controller pair has a working integration.
Does Article 15 access have a format requirement of its own?
Yes. Article 15(3) states that where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. That is weaker and more conditional than Article 20(1), which requires a structured, commonly used and machine-readable format in every case, but it means Article 15 is not silent on format.
When does the right to data portability not apply?
The Article 20 right does not apply where processing is necessary for a task in the public interest or the exercise of official authority, and it must not adversely affect the rights and freedoms of others.