Right of Data Portability.

The GDPR right of a data subject to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller. It belongs to the Privacy & Data Protection category of cybersecurity.

The GDPR right of a data subject to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

The right of data portability is established in Article 20 of the European Union General Data Protection Regulation (GDPR). It applies when processing is based on consent or on the performance of a contract and is carried out by automated means. The data subject is entitled to receive the personal data they have provided to a controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance. Where technically feasible, the data subject can require direct controller-to-controller transmission. The right is intended to foster competition and user control, complementing other rights such as access and rectification, and is enforced by national data-protection authorities.

Defences for Right of Data Portability typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: GDPR Article 20, Data portability.