Right to data portability: moving your data to another provider

Section 47 of the Data Protection Act, 2024 gives a data subject the right to receive their personal data in a reusable format and, where possible, have it sent directly to a different provider. It is a narrower right than it might first sound: it only applies where processing is based on consent or a contract, and is carried out by automated means.

An online retailer’s customer asking for their order history so they can move to a competitor’s platform is the clearest example of this right in use.

What it actually gives you

The data subject shall have the right to receive personal data concerning him or her, which he or she has provided to a data controller, in a structured, commonly used and machine-readable format and have the right to transmit such data to another data controller without hindrance from the data controller to which the personal data has been provided, where processing is based on consent or a contract, and processing is carried out by automated means. (s.47(1))

Two conditions have to both be true for this right to apply: the processing has to rely on consent or a contract as its lawful basis, and it has to be carried out by automated means. If either condition is missing, for example because the processing relies on legitimate interests, or because the records in question are manual, paper-based files, section 47 simply does not apply. That rules out a lot of processing that other rights, like access, still cover.

Getting it sent directly to someone else

Section 47(2) goes a step further than just handing the person a file. Where technically feasible, the data subject can ask for their data to be transmitted directly from one controller to another, without having to be the one moving the file themselves. In the online retailer example, that could mean the retailer sending the order history straight to the competitor’s system rather than emailing the customer a spreadsheet to forward on.

What it does not affect

Data portability does not replace or limit the right to have data deleted under right to deletion, and it does not apply to processing a business carries out to perform a duty in the public interest or under official authority. It is a right about reusing your own data elsewhere, not a general export tool for every kind of processing a business might do.