The right for data subjects to receive and transfer their personal data between data controllers if the personal data has been provided by the data subject, and the processing is based on a contract or consent.

The right to data portability is stated in Art. 20 GDPR and says that data subjects have the right to receive personal data concerning the individual. This information should be in a structured, commonly used and machine-readable format and the data subject have the right to demand that the data are transmitted those data to another controller. The control needs to fulfil this request if:

• the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1), and
• the processing is carried out by automated means.

It is also important to notice that this right only is applicable on information an individual has provided to a controller.