Data portability

What it means

Data portability is the data subject’s right to receive the personal data they themselves provided to a controller, in a structured, commonly used, machine-readable format, and to pass it to another controller. GDPR grants it only where the processing rests on consent or on a contract and is carried out by automated means.

It is not the right of access: access yields a readable copy, portability yields an export another system can ingest. Nor is it the right to erasure, because moving the data deletes nothing at the original controller.

The scope covers data the person entered themselves and data the system recorded about them while they used the service, such as order history. It excludes derived data the controller created through its own analysis, such as a credit rating or the customer’s assigned segment.

How it works in practice

The request is handled by the data protection officer or a designated employee, as a rule within one month of receipt; a complex or repeated request can be extended by two further months if the applicant is told. Handling it is free of charge.

In bookkeeping and payroll the right rarely bites: wage and accounting records are processed under a legal obligation, and portability does not reach them. Where an outside firm processes the data it runs through the processing agreement: the processor prepares the export, the controller answers for it.

For an online shop or web service it makes sense to have the export ready as a system feature rather than building it by hand for each request. We advise clients to agree a format, such as CSV or JSON, and to check that the export holds only the requester’s data and goes out by a secure route.

What to watch out for

The costly mistake is sending a whole file or a raw payroll export containing other people instead of a filtered set. That is a personal data breach: notification of the Slovak data protection authority within 72 hours, notice to those affected, and a fine out of all proportion to the cost of a properly prepared export.

Another risk is handing the data to someone merely posing as the data subject. The controller must verify the requester’s identity proportionately; an export sent to a fraudster is a personal data breach with all the duties that follow from it.