Data Portability

Executing Data Portability Requests

Overview

The right to data portability under GDPR Article 20 allows data subjects to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. This skill provides the complete workflow for assessing scope, extracting data, formatting output, and facilitating direct transfers.

Legal Foundation

GDPR Article 20 — Right to Data Portability

1. Art. 20(1) — The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

   • (a) the processing is based on consent under Art. 6(1)(a) or Art. 9(2)(a), or on a contract under Art. 6(1)(b); AND
   • (b) the processing is carried out by automated means.

2. Art. 20(2) — The data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. Art. 20(3) — The exercise of portability shall not adversely affect the rights and freedoms of others.

4. Art. 20(4) — The right to portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Scope: What Data Is Portable

Per EDPB (formerly WP29) Guidelines on the right to data portability (WP242 rev.01), portable data includes:

1. Data provided by the data subject: Information actively and knowingly provided (e.g., account details, form submissions, uploaded content).
2. Observed data: Data generated by the data subject's activity (e.g., search history, location data, activity logs, raw sensor data from connected devices).
3. NOT included — Inferred or derived data: Data created by the controller through analysis (e.g., credit scores, profiling segments, algorithmic assessments). These are the controller's intellectual output.

Legal Basis Filter

Portability applies ONLY where the legal basis for processing is:

• Art. 6(1)(a) — Consent
• Art. 9(2)(a) — Explicit consent (for special category data)
• Art. 6(1)(b) — Performance of a contract

Portability does NOT apply to data processed under:

• Art. 6(1)(c) — Legal obligation
• Art. 6(1)(d) — Vital interests
• Art. 6(1)(e) — Public interest / official authority
• Art. 6(1)(f) — Legitimate interests

Portability Request Workflow

Step 1: Receive and Validate the Request

1. Log the request with reference PORT-YYYY-NNNN.
2. Verify the requester's identity (tiered verification as per DSAR process).
3. Determine whether the request is for:
   • (a) Self-export: Data subject wants to receive their data directly.
   • (b) Direct transfer: Data subject wants data transmitted to another controller.
4. If direct transfer, obtain the receiving controller's details:
   • Organisation name and registered address
   • Technical contact email
   • API endpoint or secure transfer mechanism (if available)
   • Data format preference

Step 2: Scope Assessment

1. Identify all personal data the subject has provided or that has been observed through their use of the service.
2. Filter by legal basis — include only data processed under consent (Art. 6(1)(a)/Art. 9(2)(a)) or contract (Art. 6(1)(b)).
3. Exclude inferred or derived data (profiling scores, analytics outputs, internal assessments).
4. Exclude data that would adversely affect the rights and freedoms of others (Art. 20(3)) — redact third-party personal data from exported datasets.
5. Confirm that processing is carried out by automated means (manual paper files are excluded).

Step 3: Data Extraction

1. Query all relevant systems for the in-scope data:
   • Customer account database
   • Transaction/order history
   • User-generated content (uploads, posts, messages authored by the subject)
   • Service interaction logs (observed data)
   • Preference and settings data
   • Connected device data (if applicable)
2. Apply the scope filter from Step 2.
3. De-duplicate records across systems.
4. Validate data integrity (checksums, record counts).