What is the right to data portability?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Data portability under GDPR Article 20 lets people take their personal data with them. They can ask you to give them a machine-readable copy of it, or in some cases transfer it directly to another service.
It only applies to data you process under consent or contract, and only to data the person actively gave you: their email address, preferences they set, profile information they provided. It doesn't extend to data you've inferred or derived, like engagement scores or behavioral segments you've built from their activity.
In email marketing, a portability request typically means exporting their subscriber record in CSV or JSON format so they could, for example, import their preferences into another platform.
The timeline matches other data subject rights: one month to respond, with a possible two-month extension for complex requests if you notify them within the first month.
This is distinct from a regular access request. The access right is about getting information. Portability is about getting data in a format that's actually usable somewhere else. If technically feasible, you may even be required to transfer it directly to another controller they specify.
Check that your ESP supports clean data exports including consent records. Consent documentation is the legal foundation for any consent-based processing you've done, and it should travel with the data.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
