Right to data portability

The right to data portability is the right of the data subject to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance, including, where technically feasible, by having the data transmitted directly from one controller to another (Art. 20 GDPR).

The right is narrower than access. It applies only where the processing is based on consent or on a contract and is carried out by automated means. It covers data "provided by" the individual, which the Article 29 Working Party Guidelines (WP242) interpret as including data actively submitted and data observed from the individual's activity (such as sensor readings or usage logs), but not data inferred or derived by the controller (such as a risk score or a diagnosis). It must not adversely affect the rights of others and does not apply to processing necessary for a task in the public interest.

In digital health the right is directly relevant: a user of a wellness or disease-management app processed under contract or consent can demand an export of their entries and device data. In clinical trials, where the sponsor relies on public interest, legitimate interest or legal obligation rather than consent, portability generally does not apply to the trial dataset, although participants keep their right of access. The European Health Data Space regulation goes further for electronic health records, giving patients a right to access and share their health data in the European electronic health record exchange format regardless of legal basis, and the Data Act adds portability rights for data generated by connected devices.