For years you have used an app to log your workouts, a music service with carefully built playlists, a photo manager with thousands of images sorted into albums. The day you want to change provider, the fear is having to start from scratch. The right to data portability, introduced by Article 20 of Regulation (EU) 2016/679, exists to stop your data from becoming a chain that ties you to a service.
What it consists of
Article 20 grants you two entitlements:
- to receive the personal data you have provided to a controller in a structured, commonly used and machine-readable format;
- to transmit that data to another controller without hindrance from the first one and, where technically feasible, to have it transmitted directly from one controller to the other.
Formats such as CSV, JSON or XML normally meet the requirement. A PDF with screenshots of your profile, on the other hand, is readable by a person but not by a program, and so does not serve the purpose of the rule.
When it applies
Portability does not cover every kind of processing. There are three conditions and they must all be met.
- The processing is based on your consent or on a contract to which you are a party.
- The processing is carried out by automated means: paper records are excluded.
- The data is data you have provided.
This excludes, for example, processing based on a legal obligation or on the controller's legitimate interest, and processing carried out in the exercise of official authority.
Which data counts as "provided by you"
The phrase is broader than it looks. It includes:
- data you entered knowingly, such as your name, address, uploaded content, messages and photos;
- data observed through your use of the service, such as search history, songs played, routes recorded by a fitness app, readings from a connected device.
It does not include data inferred or derived by the controller, such as a reliability score or an interest profile calculated by an algorithm. For those you can still exercise the right of access under Article 15.
Portability and access: the differences
| Access (Art. 15) | Portability (Art. 20) | |
|---|---|---|
| Purpose | Know the data and how it is used | Reuse the data elsewhere |
| Data covered | Everything processed, including inferred data | Only data provided, including observed data |
| Legal bases | All | Consent and contract only |
| Format | May be unstructured | Structured and machine-readable |
| Direct transfer to third parties | No | Yes, where technically feasible |
How to exercise it in practice
Many large services already offer export tools in the account settings: look for options such as "Download your data", "Export" or "Download archive". They are the quickest route, but they do not always include everything.
If there is no automatic tool, or it is incomplete:
- write to the controller or the Data Protection Officer named in the privacy notice;
- state that you are exercising the right to data portability under Article 20;
- specify the format you want or, at least, ask for a structured, machine-readable format;
- if you want a direct transfer, name the new provider.
The deadline to reply is one month, extendable by two months in complex cases. Delivery is normally free of charge.
Limits worth knowing
Other people's rights. If the data includes information about third parties, such as address book contacts or conversations with other people, the new controller may process it only for your personal use and not, for example, to send advertising to those contacts.
Erasure is not automatic. Exercising portability does not mean the first service deletes the data. If you want to end the relationship, add an erasure request under Article 17 once you have checked that the export is complete.
Compatibility is not guaranteed. The rule requires an interoperable format; it does not oblige controllers to adopt systems compatible with each other. Before closing the old account, check that the new service can import the files.
A concrete example
You decide to move from one photo storage service to another. The export gives you the original images and a file with album information, captions and dates. You import everything into the new service, check that the folders are intact and only then ask for the old account to be deleted. That way you avoid both losing data and leaving it forgotten on a server you no longer use.
In short
- Article 20 GDPR lets you receive the data you provided in a structured, machine-readable format and move it to another service.
- It applies only to automated processing based on consent or contract.
- It covers data you entered and data observed, not data inferred by the controller.
- Check that the export is complete and importable before requesting erasure.
- Portability does not allow the new service to use third parties' data for its own purposes.