Article 20 — Right to Data Portability

Legal Provision

Right to data portability: establishes the data subject right to receive personal data in a structured, commonly used machine-readable format to transmit that data to another controller.

Scope

Applies to entities processing personal data: data controllers.

Requirement type

Duty: the data controller must make data available in a portable format

Actions to demonstrate compliance

• Binary (yes/no)
• Procedures and tools enabling export of data in structured, machine-readable format.
• Records of requests and completed transfers.
• Secure transfer mechanisms (e.g., encrypted formats).
• API interfaces.
• Non-Binary (requires contextual assessments)
• Evaluation of scope and limitations of requested data.
• Review of technical feasibility of direct transmission between controllers.
• Communication of reasons if request is denied or delayed.

Monitoring requirement

• Monitoring of format compliance and export logs.
• Documentation of processing within the entity’s organisation and legal bases.

Consequences of non-compliance

• Fines up to €20 million or 4% of global turnover.
• Complaints by data subjects.
• Negative reputational consequences.