Taking along what was once given
Article 20 GDPR grants the right to receive data provided in a machine-readable format and to take it to another provider. It is the youngest of the data subject rights and the only one not aimed at data protection alone, but at competition too.
The thought behind Article 20 is an economic one. Anyone who has accumulated contacts, messages or measurements in a service for years stops switching providers – not because of price, but because the move looks impossible. That lock-in is no side effect; with many services it is a business model. The right to portability attacks exactly there: it makes the accumulated stock movable.
In intent it therefore differs markedly from the other data subject rights. Access, rectification and erasure protect against a processing operation; portability protects against a dependency.
Three conditions that have to coincide
The right is cut more narrowly than the others. It applies only where processing rests on consent or on a contract – not on legitimate interests, not on a legal obligation. Processing must additionally be automated; a paper file drops out. And the data must have been provided by the data subject.
That last element carries most of the dispute. Actively entered details are provided beyond doubt. On the reading of the European supervisory authorities, however, observed data counts too – search histories, location points, readings from a device. Inferred data is not covered: a credit score or an advertising profile is the result of an analysis and therefore not provided but generated.
Does Article 20 reach this data set?
What machine-readable actually demands
The Regulation names three properties of the format: structured, commonly used, machine-readable. What is meant is not a particular file type but an outcome – another service should be able to read the data in without retyping it. A PDF holding a scanned table fails that, even though it is technically a file. A screenshot fails even more clearly.
The most common form of refusal is therefore not rejection but useless compliance: a release that formally contains everything and practically permits nothing.
Two releases of the same holdings
The striking thing about the right to portability is how rarely it is exercised – and how strongly it works nonetheless. Large providers keep export tools ready because the right exists, not because demand forces them to. The Data Act has extended that approach to connected devices since 2025 and corrected the decisive weak point in doing so: there the duty applies regardless of whether the data was provided or generated during operation.