Skip to content

GDPR Article 20: Right to Portability

Cat Coode 12/23/19 9:00 PM

Table of Contents

GDPR Article 20 is Right to data portability.

What it is 

This is where the user can receive and read their data. They can also transfer this data to a similar company or service.

The data subject has the right to receive their data in a format that is usable to them or another organization. This allows the subject to read their own data and/or transfer it to another organization with similar goals. The suggested format is a Comma Separated Values (CSV) which can be read by the human eye and interpreted by most spreadsheets and databases.

Why it is important for the Data Subject

A user has the right to know exactly what personal data has been collected about them, including inferences based on their data. The ability to access this data gives the user insight but also allows them to switch service providers without problem.

What It Means to the Organization 

In order to hand a user their data, the organization has to identity the personal data and retrieve it from their system. They will also need to package that data in a way that is readable. This could be anything from an automated creation of a CSV to the photocopy and mailing of a subject’s personal records.

Real World Example 

A registered massage therapist receives multiple clients for massage. A current client would like to change to a new therapist and requests their personal data. The therapist is required to locate all personal data about the user which may include personal contact information, payment history, and any notes taken about the patient’s health. This must be returned to the client in a way they can read it and have it read by a new therapist.

Questions about GDPR and the Data Subject Rights? Check out our full article on GDPR or contact us.