Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated text

EN

Article 20 Right to data portability

Summary What does Article 20 of the GDPR regulation say?

This article establishes the right to data portability for data subjects under the GDPR.

It gives individuals the right to obtain their personal data from a controller in a usable, machine-readable format and to move that data freely to another controller.

The right is not unlimited, however — it only applies where processing is based on consent or contract and is carried out by automated means.

The article also makes clear that this right does not override the right to erasure under Article 17, and cannot be used in ways that harm others or in public interest/official authority processing contexts.

Important points:

Data subjects can request their personal data in a structured, commonly used and machine-readable format and transmit it to another controller without hindrance.
The right only applies where processing is based on consent or contract and is carried out by automated means.
Direct controller-to-controller transmission is required where technically feasible, but the right cannot be exercised in a way that adversely affects the rights and freedoms of others.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
  1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
  2. the processing is carried out by automated means.
1. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
1. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
1. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.