GDPR Art. 20 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Right to data portability

Data Portability Data Portability
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

    Data Portability Data Portability Personal Data 29
    1. a)
      the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
      Consent
    2. b)
      the processing is carried out by automated means.
  2. 2.

    In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

    Data Portability Data Portability Personal Data 18
  3. 3.

    The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

    Controllers 7
  4. 4.

    The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

    10

Enforcement

Cited in 9 fines totalling €1.2M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (5) · median fine €59,600 · see all enforcement for Art. 20 →

Connections by provision

20(1) 14 Case Law 5 Enforcement 10 Guidance .md
Case Law 14
CJEU - C-205/21 - Ministerstvo na vatreshnite raboti Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725 High Court examines DPA inquiry into Meta's refusal of raw data access and portability Criminal proceedings against V.S Les Mousquetaires and ITM Entreprises v European Commission Safe Interenvios, SA v Liberbank, SA and Others ¶3.8 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR +6 more
Enforcement 5
Persónuvernd (Iceland) - 2025010364 CNPD (Portugal) - Deliberação 2019/494 ¶3 Persónuvernd (Iceland) - 2025010364 ¶9 Persónuvernd (Iceland) - 2025010364 ¶29 Persónuvernd (Iceland) - 2025010364
Guidance 10
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria ¶155 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶33 Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria ¶68 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶47 Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation ¶45 Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation +2 more
20(1)(b) 2 Case Law 2 Enforcement .md
Case Law 2
GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725 ¶15 GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725
Enforcement 2
BfDI: Telekom must name all recipients, data origin and deletion dates in Art. 15 replies ¶16 BfDI: Telekom must name all recipients, data origin and deletion dates in Art. 15 replies
20(2) 12 Case Law 6 Guidance .md
Case Law 12
VS v Inspektor v Inspektorata kam Visshia sadeben savet CJEU - C-614/10 - Commission v. Austria Ligue des droits humains ASBL v Conseil des ministres Les Mousquetaires and ITM Entreprises v European Commission Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. ¶5 Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. ¶39 Les Mousquetaires and ITM Entreprises v European Commission ¶34 Ligue des droits humains ASBL v Conseil des ministres +4 more
Guidance 6
Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( ¶118 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( ¶119 Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision ¶118 Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision ¶119 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (
20(3) 2 Case Law 5 Guidance .md
Case Law 2
BVwG - W214 2235505-1 ¶18 BVwG - W214 2235505-1
Guidance 5
EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶149 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶191 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶72 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
20(4) 4 Case Law 5 Guidance 1 Literature .md
Case Law 4
High Court examines DPA inquiry into Meta's refusal of raw data access and portability BVwG - W214 2235505-1 ¶43 High Court examines DPA inquiry into Meta's refusal of raw data access and portability ¶18 BVwG - W214 2235505-1
Guidance 5
Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶70 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶51 Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria ¶72 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
Literature 1
General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?

Related across sources

Guidelines 01/2022 data subject rights - Right of access Guidelines Apr 17, 2023 Right of Access Personal Data Right to Rectification
Guidelines 10/2020 restrictions under Article 23 GDPR Guidelines Oct 13, 2021 GDPR Subject-Matter and Objectives Right to Restriction Data Portability
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent Guidelines May 4, 2020 Consent Data Portability Personal Data
2018 Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) Guidelines on transparency Apr 11, 2018 Transparency Information Provision Modalities and Communication Methods Fairness & Transparency
Guidelines 1/2020 processing personal data in the context of connected vehicles and mobility related applications Guidelines on processing of personal data through video devices Guidelines Jan 28, 2020 Personal Data Privacy by Design & Default Processing
Guidelines 03/2022 Deceptive design patterns in social media platform interfaces: how to recognise and avoid them Guidelines Feb 24, 2023 Privacy by Design & Default Privacy by Design Privacy by Default