The General Data Protection Regulation (GDPR) provides individuals with several rights regarding their personal data. Two of the most important — but often confused — rights are:
-
Right of Access (Article 15)
-
Right to Data Portability (Article 20)
Below is a comparison and contrast of these two rights, including practical examples of when each is best used.
Overview of Each Right
Right of Access (Article 15)
This gives individuals the right to:
-
Obtain confirmation of whether their personal data is being processed.
-
Access the data itself.
-
Receive supplementary information (e.g., purposes of processing, categories of data, recipients, retention periods, etc.).
Exercising the right of access is also known as making a subject access request. You can read more about how to handle subject access requests here.
Right to Data Portability (Article 20)
This gives individuals the right to:
-
Receive their personal data in a structured, commonly used, machine-readable format.
-
Transmit that data to another controller, or have it transmitted on their behalf
-
this right only applies where processing is based on consent or a contract and carried out by automated means.
Key Differences
|
Feature |
Right of Access |
Right to Data Portability |
|---|---|---|
|
Purpose |
Transparency; helps verify what personal data is being processed and what that processing is for. |
Enables the reuse of personal data across services. |
|
Format of Data |
Typically human-readable (e.g., PDF, printout). |
Machine-readable (e.g., CSV, JSON, XML). |
|
Legal Basis Required |
Applies regardless of legal basis. |
Only applies when processing is based on consent or contract, and done by automated means. |
|
Transfer to Third Parties |
No obligation to facilitate data transfer. |
Includes the right to have data transferred directly to another controller (where technically feasible). |
|
Scope of Data |
Broad — includes all personal data, metadata, and processing details. |
Narrower — only includes personal data provided by the individual. |
Sign Up Here:
Example 1: Employment Record Request An employee wants to see what HR records, emails, and performance evaluations their employer holds on them. Best suited for the right of access, as the individual wants to view all types of personal data being processed. It can help to provide a complete and accurate picture of the use of personal data if there is a dispute or complaint between employer and employee Example 2: Marketing Concerns A customer receives unwanted marketing emails and wants to check what data the company holds and how it obtained it. The access request helps uncover data sources and purposes of processing. It can help inform any further use of GDPR rights such as the right to restrict processing. Example 1: Switching Banks or Utilities A customer wants to move their account history and billing information from one energy provider to another. Portability allows the transfer of their usage and billing data directly to the new provider in a structured format. Many organisations in the financial industry now offer data portability as a part of their services as standard Example 2: Moving Fitness Data A user wants to move their step counts, heart rate data, and workout logs from one health tracking app to another. Since the data was provided via a contract or consent and processed automatically, portability applies. It means the individual can maintain their fitness history without any gaps or interruptions
Aspect Right of Access Right to Data Portability Purpose Understand and verify data usage Transfer data to another service Scope All personal data Data provided by the user Format Human-readable Machine-readable Legal basis Any Consent or contract only Automation requirement No Yes Third-party transmission Not required Must be facilitated if feasible Limits Things may be redacted or not released if they contain the data of other people Only applies to data under certain legal bases only and will not include narrative or long form data. Use the Right of Access to get a comprehensive view of what data is held and how it’s being used. Use the Right to Data Portability when you want to reuse your data elsewhere, such as switching digital services. Both rights promote transparency and individual control, but serve different purposes within the GDPR framework. Gain the practical skills you need to identify and manage data protection and GDPR with this five-star rated training course. Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.Practical Examples
When to Use the Right of Access
When to Use the Right to Data Portability
Summary Table
Conclusion
