Data portability is a right to receive certain data in a structured, commonly used, machine-readable form and transmit it elsewhere.
Article 20 applies more narrowly than subject access. It generally covers personal data you provided to a controller where processing is based on consent or contract and carried out by automated means.
The purpose is practical reuse and transfer, not a universal right to every internal record in a portable format.
Key points
- Portability and SAR are different rights.
- The right usually focuses on data you provided, including some data observed from your use.
- It does not generally extend to inferred/derived data in the same way.
- Direct transfer to another controller may be requested where technically feasible.
When portability applies
Check three elements: the lawful basis is consent or contract; processing is automated; and the data falls within the relevant “provided by” scope. A paper-only public-authority file, for example, is unlikely to fit the ordinary portability test.
Format
The output should be structured, commonly used and machine-readable. Depending on the data, CSV, JSON or another interoperable format may be appropriate. A PDF image dump may not satisfy the practical purpose of portability for structured data.
Third-party rights
Portable datasets can contain information relating to other people. The controller must consider their rights and freedoms when transmitting or providing data.
In practice
- Use portability when you want reusable structured data, not merely a copy to read.
- Specify the relevant account/service and desired transfer where feasible.
- Use SAR alongside portability if you also need wider internal personal data.
What to do
A practical next-step plan
- Check consent/contract basis.
- Identify the data you provided/observed.
- Request a structured machine-readable format.
- Ask for direct transfer if technically feasible.
Common traps
Things that often confuse the issue
- Portability does not cover every piece of personal data.
- It is not the same as Open Banking rights or every statutory data-sharing scheme.
- Machine-readable does not necessarily mean a format of your personal choosing.
Evidence worth keeping
Be specific about format and transfer.
Ask what export formats are available and, if you want direct transmission, provide the receiving controller’s details and ask whether direct transfer is technically feasible. Do not send sensitive credentials simply to facilitate a transfer.
Useful wording.
“I am exercising my right to data portability for the personal data I provided that is processed by automated means on the basis of [contract/consent]. Please provide it in a structured, commonly used and machine-readable format and tell me whether direct transmission to [recipient] is technically feasible.”
Derived and inferred information can fall outside the portability dataset.
The right is not a general entitlement to proprietary analysis, internal scoring or every inference generated by the controller. If you also need those records as personal data, make a SAR alongside the portability request. Keeping the two rights separate avoids a controller treating the narrower portability scope as the limit of your access rights.
Ask for the right remedy: a usable dataset, not merely a PDF dump.
Where portability applies, the point is machine reuse. A readable PDF may satisfy some access purposes but can be poor portability if the data should reasonably be supplied in a reusable structured format. Identify the service/account, the data you want and the intended transfer or reuse.
| Need | Usually better route |
|---|---|
| Copy of all personal data and supplementary information | Subject access request. |
| Reusable account/activity data meeting the portability conditions | Data portability. |
| Correction of wrong data | Rectification. |
| Transfer directly to another controller where technically feasible | Portability request specifying the recipient. |
Portability is narrower than subject access.
The right to data portability is designed to let you obtain and reuse certain personal data in a structured, commonly used and machine-readable format. It does not apply to every record an organisation holds. In the ordinary UK GDPR regime it generally applies where processing is based on consent or contract, is carried out by automated means and concerns data you provided to the controller.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.