Data Governance Atlas UK edition

Data portability

How to handle a data portability request under UK GDPR Art 20: when the right applies, what format to use, direct transmission to another controller, and protecting other people's data.

Applies to
Controllers processing by automated means on the basis of consent or contract. Not available for processing under public task.
Instruments
UK GDPR, DPA 2018
Steps
8 steps, with a deadline calculator, including a step that carries a criminal offence.

Deadline calculator

Other data subject rights request

Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.

Enter a date to calculate.

Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item Position
Deadline One calendar month from receipt
Extension Two further months for complex or numerous requests, notified within the first month
Stop the clock While reasonably waiting for identity or clarification (Art 12A)
Cost Free; a reasonable fee or refusal only if manifestly unfounded or excessive
Scope Data the person provided, processed by automated means on consent or contract
Format Structured, commonly used and machine-readable

Steps

  1. Recognise and log the request

    Any form. Log the date received.

    See UK GDPR

  2. Check the right applies

    The data must be personal data the person provided to you (including observed data such as activity logs), processed by automated means, on the basis of consent or contract. The right does not apply to processing necessary for a public task.

    See UK GDPR

  3. Prepare the data

    Provide it in a structured, commonly used and machine-readable format, such as CSV or JSON, with enough metadata to be reusable.

    See UK GDPR

  4. Transmit directly if asked and feasible

    If the person asks and it is technically feasible, send the data directly to another controller.

    See UK GDPR

  5. Protect other people

    Do not adversely affect the rights and freedoms of others: remove or redact third-party data that should not go to the new controller.

    See UK GDPR

  6. Respond within one month

    Provide the data or explain why the right does not apply. Portability does not by itself require erasure.

    See UK GDPR

    Criminal offence Altering, destroying or concealing data to stop it being provided in response to a portability request is an offence under DPA 2018 s.173, as for subject access.

  7. Refuse only with reasons

    If you do not act, tell the person within the deadline why, and that they can complain to you, then to the Information Commission, and seek a judicial remedy. Manifestly unfounded or excessive requests may be refused, but you must be able to show why.

    See UK GDPR

  8. Handle any complaint

    A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.

    See DPA 2018

Checklists and tools for this procedure

Explainers

Sources