---
title: "Art. 20 GDPR: Right to data portability"
canonical: "https://dposchool.com/gdpr/article/20"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_20"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 20 GDPR · Chapter III: Rights of the data subject · Section 3: Rectification and erasure

# Article 20 GDPR: Right to data portability

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Where processing is based on consent or contract and carried out by automated means, the data subject has the right to receive the personal data he or she provided in a structured, commonly used and machine-readable format and to transmit them to another controller. Where technically feasible, the data subject may have them transmitted directly from one controller to another.

## Official text

### Article 20(1)

**1.** The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

#### Article 20(1)(a)

**(a)** the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

#### Article 20(1)(b)

**(b)** the processing is carried out by automated means.

### Article 20(2)

**2.** In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

### Article 20(3)

**3.** The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

### Article 20(4)

**4.** The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 20 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_20)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 68](https://dposchool.com/gdpr/recital/68)

## EDPB guidance

### [Guidelines on the right to data portability](https://dposchool.com/gdpr/guidance/wp242-rev-01)

WP242 rev.01 · Final · Endorsed by the EDPB 25 May 2018

Date is the EDPB endorsement date.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-on-the-right-to-data-portability-under-regulation-2016679-wp242_en)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 20

Previous: [Art. 19 GDPR: Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://dposchool.com/gdpr/article/19)

Next: [Art. 21 GDPR: Right to object](https://dposchool.com/gdpr/article/21)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents