Data portability is the right to receive personal data in a structured, commonly used, machine-readable format and transmit it elsewhere. It gives people greater control over information held about them, while placing corresponding responsibilities on organizations that collect and process personal data. section 3.14 section 3.15
The right became part of the GDPR, which became enforceable in 2018 and applies beyond the European Union when organizations process EU individuals’ personal data. It appears alongside rights to access, rectification, erasure, restriction, objection, and safeguards concerning automated decision-making and profiling. section 3.14 section 3.15
Its significance depends on the surrounding legal framework:
- The GDPR treats portability as one element of a broad, rights-based privacy regime that also emphasizes transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. section 3.15
- Other jurisdictions take different approaches: Brazil’s LGPD closely follows the GDPR, China’s PIPL emphasizes consent and data controls, and the United States generally relies on sector-specific rules and notice-and-choice mechanisms. section 3.14
- Portability does not by itself resolve broader privacy questions, such as whether data collection has a lawful basis, whether information is accurate, or how organizations use transferred data. section 3.15
