Data Portability under GDPR: Scope, Formats, and Limits

Data portability is the right recognized by Article 20 of the General Data Protection Regulation (GDPR) to receive certain personal data and, if desired, transmit them to another data controller. The delivery must be in a structured, commonly used, and machine-readable format. The right also allows requesting direct transmission between controllers when technically feasible.

Its practical purpose is to enable individuals to store and reuse information about themselves without being tied to the format chosen by a service. It can facilitate switching providers or using data in another tool, but it does not guarantee automatic import or that the receiving service offers the same functions. Article 20 concerns personal data, not transferring an entire account or replicating a product.

It is useful to distinguish three uses of the word portability. GDPR portability is a data protection right; numeric portability allows keeping a phone number when changing operators; and technical migration moves databases, applications, or files between systems. They are similar in that they involve transferring something, but they have different objectives and rules.

The right applies when processing is carried out by automated means and is based on the individual's consent or a contract with them. Additionally, the data must concern the person requesting portability and have been provided to the controller. It does not apply, for example, to processing necessary for a task in the public interest or the exercise of official authority.

The scope of 'provided' is not limited to what was written in a form. Guidelines on portability include both data communicated consciously—such as a name or a list created by the user—and certain data observed while using a service. Among the latter may be activity logs, usage histories, traffic or location data, depending on the processing and circumstances.

In contrast, data inferred or deduced by the controller from other data through its own analyses, such as an assessment or prediction created by the service, are outside the portability right. The boundary depends on how each data point was generated: the fact that information describes a person is not enough by itself for it to be portable under Article 20. The right of access is distinct and has a different scope.

Data of other people also requires care. If a set includes information that identifies or affects third parties—for example, a shared conversation—its delivery must not harm their rights and freedoms. Portability does not authorize unlimited disclosure of others' information: the controller must consider the circumstances and protect the data of other individuals.

The GDPR requires a format that is structured, commonly used, and machine-readable. In practical terms, the information must retain an organization that allows processing via software, not be reduced to an image or a document difficult to reuse. Guidelines mention the development of interoperable formats and tools that help download or transmit data as good practices.

JSON, CSV, and XML are common examples of structured formats that can be machine-readable, but the GDPR does not prescribe one of them for all cases. The choice depends on the data and how they are organized. A CSV file may serve for simple rows and columns; JSON or XML can represent nested structures with more detail. Having a known file extension does not guarantee by itself that it is complete, understandable, or importable without adjustments.

Portability also does not require the controller and the receiving service to use compatible systems. Recital 68 of the GDPR encourages promoting interoperable formats but clarifies that the right does not oblige creating or maintaining universal technical compatibility. Therefore, receiving a portable file does not equal completing the migration: fields may need adaptation, duplicates resolved, or verification of what data the new service accepts.

These characteristics describe the format, not determine by themselves which data must be included. First, it is evaluated if each data point falls within the scope of Article 20; then, how to deliver it so it can be received and reused.

The request is submitted to the company or body that processes the data, not to the Spanish Data Protection Agency (AEPD) for it to collect them. The AEPD offers a guiding form to address the controller. In the request, it is advisable to identify the person, indicate that the Article 20 right is being exercised, and describe the data or service it refers to, as well as specify if direct transmission is requested and to which controller.

The controller may verify identity when having reasonable doubts, but additional information requested must be proportional. If a person acts through a representative, it may be necessary to prove that representation. It is useful to keep a copy of the request and proof of its sending; if the response does not arrive or does not resolve the request, these elements help document what happened.

The general deadline to respond to a GDPR rights request is one month from receipt. It can be extended by up to two additional months when necessary due to complexity or number of requests, but the controller must inform of the extension and explain its reasons within the first month. This deadline is for responding; it does not mean that any transfer between services must be completed in a month.

A simple sequence to prepare the request is: identify the controller, delimit the data or period of interest, request a portable copy or direct transmission, and specify the recipient if the latter option is chosen. If direct transmission is not technically possible, the right still contemplates that the person receives their data to manage them themselves.

Direct transmission between controllers is recognized only when technically feasible. Article 20 does not oblige two organizations to maintain a connection between their systems or for the receiver to accept any data structure. Interoperability facilitates the transfer, but depends on the design of the services and the formats used.

The right also does not annul other obligations of the controller or the right to erasure. The GDPR establishes that exercising portability does not harm the right to request data deletion; at the same time, requesting a portable copy does not automatically eliminate data that the controller must retain for other legal or contractual reasons. They are distinct rights and may require separate requests.

Portability must not negatively affect the rights and freedoms of other people. This may require protecting or excluding parts of a shared set, without turning the request into an authorization to reveal third-party data. Furthermore, a request about personal data does not give the right to obtain any internal document, trade secret, analysis, or code used by the service.

Practical limitations also appear in the interpretation of the scope: the user may receive input data and certain observed data, but not necessarily profiles, scores, or conclusions generated by the provider. Therefore, when changing services, it is advisable to review which specific categories are included and which elements are not transferred, instead of assuming the complete account history is exported.

In a music service, a playlist created by the user is a clear example of input information; listening logs may be data observed by the service and enter the portability analysis depending on the context. A recommendation or score generated from those logs is different: it may constitute a provider inference, not a provided data point in the sense of this right.

In email or social networks, an export could include profile data and certain activities, but messages and contacts may involve other people. The presence of shared information requires considering their rights. In health or banking services, Article 20 does not create an automatic sectoral category: the legal basis of processing, whether it is automated, and how each data point was generated must be checked. The right also does not guarantee that the receiving application accepts the file without adaptation.

Numeric portability is another figure. For example, the Mexican telecommunications authority describes that right as keeping the same number when changing operators. It is not about exporting personal data under GDPR, nor should its deadlines or conditions be confused with those of Article 20. A database migration, for its part, is a technical project and may include data or systems that are not the object of this individual right.

In summary, personal data portability serves to obtain and reuse a defined part of information linked to a person, under specific legal conditions. Before exercising it, it helps to distinguish which data were input, which were observed, and which were inferred; then, choose between receiving the file or requesting its direct transfer. The result is control over certain data, not a guarantee of service change without friction.