Artikel 20 Rätt till dataportabilitet

This article establishes the right to data portability for data subjects under the GDPR.

It gives individuals the right to obtain their personal data from a controller in a usable, machine-readable format and to move that data freely to another controller.

The right is not unlimited, however — it only applies where processing is based on consent or contract and is carried out by automated means.

The article also makes clear that this right does not override the right to erasure under Article 17, and cannot be used in ways that harm others or in public interest/official authority processing contexts.

Important points:

• Data subjects can request their personal data in a structured, commonly used and machine-readable format and transmit it to another controller without hindrance.
• The right only applies where processing is based on consent or contract and is carried out by automated means.
• Direct controller-to-controller transmission is required where technically feasible, but the right cannot be exercised in a way that adversely affects the rights and freedoms of others.