← Back to all guidesUpdated Sep 28, 2026
Under GDPR Article 20 you have a legal right to receive personal data you have provided to a company in a structured, machine-readable format. And to have it transmitted directly to another service where technically feasible. In the US, CCPA §1798.100 grants a related but narrower right; California, Colorado, Connecticut, Virginia, and most other states have equivalent statutes. This guide covers what those rights actually mean in practice, what data is and is not covered, and how to use them.
Written by Charles
What data portability means
Data portability is the right to receive personal data you have provided to a company in a structured, commonly used, machine-readable format.
In plain English: you should not be locked into a service just because your data is trapped there.
What the GDPR right covers
Under GDPR Article 20, the right to data portability applies when processing is based on your consent or on a contract.
- Data you typed in, like profile details or contact information
- Files you uploaded, like photos, documents, or messages
- Observed activity data, like search history or listening history
- It does not generally cover inferred or derived data like internal scores
What it does not mean
- Portability is separate from deletion
- Not every dataset is covered
- Direct transfer only applies where technically feasible
How to use portability in practice
- Pick one service you use heavily.
- Request your export and save it in a clearly labeled folder.
- Open the files and check whether they are actually understandable.
- Store one local copy and one off-site backup.
- Repeat once or twice a year so your archive stays current.
Sources consulted
The legal framework and definitions in this guide come from the primary regulatory texts and authoritative interpretations below.
- GDPR Article 20 (Right to data portability): https://gdpr-info.eu/art-20-gdpr/. The EU regulation that establishes portability as a binding right
- GDPR full text: https://eur-lex.europa.eu/eli/reg/2016/679/oj. The official consolidated regulation, Article 20 begins at the recital in para 68
- California Consumer Privacy Act: https://oag.ca.gov/privacy/ccpa. §1798.100 grants the related disclosure right; the California Privacy Protection Agency (CPPA) maintains regulations
- ICO guidance on the right to data portability. Https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-to-data-portability/. UK Information Commissioner's Office interpretation of the same right under UK GDPR
- European Data Protection Board guidelines on portability. Https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-right-data-portability_en. EDPB Article 29 Working Party guidance that preceded Article 20 in practice
FAQ
Is data portability a legal right?
Yes. Under GDPR Article 20, individuals have a right to data portability in certain situations.
Does exporting my data delete it from the company?
No. Exporting and deletion are separate things.
What is a good export format?
CSV and JSON are usually the most useful because they are structured, machine-readable, and widely supported.