Data Portability Request Handling
Plain English Translation
Under GDPR Article 20, individuals have the right to receive the personal data they provided to an organization in a structured, commonly used, and machine-readable format. Organizations must allow individuals to transmit this data to another controller, or transmit it directly if technically feasible. This right applies when processing is based on consent or a contract and is carried out by automated means, empowering users to move their data across services without hindrance.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Designate a point of contact for manual data exports in standard formats like CSV or JSON.
- Maintain a log to track and fulfill data portability requests within the one-month deadline.
Required Actions (scaleup)
- Develop internal scripts or tooling to quickly aggregate and format a user's provided personal data upon request.
- Establish secure delivery mechanisms, such as encrypted zip files or authenticated secure download links.
Required Actions (enterprise)
- Build automated, self-service data export capabilities directly into the product or user dashboard.
- Provide direct system-to-system transfer capabilities or open APIs to other major controllers where technically feasible.
Evidence Required
The right to data portability under GDPR Article 20 allows individuals to obtain their personal data and reuse it for their own purposes across different services. It requires controllers to provide the data in a structured, commonly used, and machine-readable format to empower users to move or copy personal data easily from one IT environment to another.
To handle a GDPR data portability request, organizations must first verify the identity of the requester to prevent unauthorized disclosure. Once verified, the organization must compile the relevant automated data and provide it securely within the standard one-month timeframe via a secure download link or direct transmission.
A GDPR data portability export must include data that the data subject has actively and knowingly provided to the controller, as well as data observed from their activities. It applies only when processing is carried out by automated means and is strictly based on the user's consent or a contract.
No, what data is covered by GDPR Article 20 is strictly limited to data directly provided by or observed from the data subject's activities. It does not cover inferred or derived data, such as algorithmic user profiles, credit scores, or analytical categorizations generated internally by the controller.
The regulation requires that data be provided in a structured commonly used machine-readable format GDPR. Utilizing open standard formats like CSV JSON XML for GDPR data portability is highly recommended because they allow other systems and controllers to easily parse and import the transferred information.
The standard GDPR data portability request timeframe one month applies from the date of receipt. However, this deadline can be extended by a further two months if the request is particularly complex or if the organization is facing a high volume of requests, provided the data subject is informed of the delay and the reasons for it.
A GDPR Article 20 data portability vs right of access comparison reveals that access requests have a broader scope that includes derived data and processing details, often provided as a PDF or basic web view. Data portability strictly concerns automated data provided by the user and demands a machine-readable format specifically designed for system interoperability.
Yes, Article 20 encompasses the right to have personal data transmitted directly from one controller to another, provided the transmission is technically feasible. Organizations are not forced to adopt systems that are technically compatible with specific competitors, but they must facilitate the direct transfer if standard secure communication methods exist.
Organizations must implement a secure GDPR data portability request process that includes reasonable steps to verify the requester's identity. This generally involves requiring the user to authenticate through their existing application account or requesting additional identity verification materials if the request is submitted via an external channel.
When determining how to securely transmit data to another controller GDPR or to the user, organizations should use end-to-end encryption, secure file transfer protocols, or password-protected ZIP files sent through a secondary communication channel. Ensuring data integrity and confidentiality during transit is essential to prevent unauthorized access or accidental data breaches.
Data portability requests often fail in practice due to scattered intake channels, unclear ownership, and missed deadlines. Tools like WatchDog Security's Compliance Center can centralize request intake evidence, map the request to GDPR Article 20 requirements, and surface gaps (e.g., missing identity checks or insecure delivery methods) so teams can close them before an audit or incident.
Export files can contain highly sensitive personal data, so sending attachments over email creates avoidable exposure and weak auditability. Tools like WatchDog Security's Secure File Sharing can support encrypted delivery with access controls and audit logs, helping teams provide a secure download mechanism while retaining evidence of who accessed the export and when.
"The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the processing is carried out by automated means."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-23 | WatchDog Security GRC Team | Initial publication |
