| name | data-portability |
| title | Executing Data Portability Requests |
| description | Executes GDPR Article 20 data portability requests, covering machine-readable format requirements (JSON, CSV, XML), direct controller-to-controller transfer mechanisms, and scope limitations to data provided by the subject on consent or contract basis. Activate for portability, data export, Art. 20, data transfer queries. |
| author | onfire7777 |
| author_url | https://github.com/onfire7777/universal-ai-skills-library/tree/main/skills/data-portability |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Executing Data Portability Requests
Overview
The right to data portability under GDPR Article 20 allows data subjects to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. This skill provides the complete workflow for assessing scope, extracting data, formatting output, and facilitating direct transfers.
Legal Foundation
GDPR Article 20 — Right to Data Portability
-
Art. 20(1) — The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
- (a) the processing is based on consent under Art. 6(1)(a) or Art. 9(2)(a), or on a contract under Art. 6(1)(b); AND
- (b) the processing is carried out by automated means.
-
Art. 20(2) — The data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
-
Art. 20(3) — The exercise of portability shall not adversely affect the rights and freedoms of others.
-
Art. 20(4) — The right to portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Scope: What Data Is Portable
Per EDPB (formerly WP29) Guidelines on the right to data portability (WP242 rev.01), portable data includes:
- Data provided by the data subject: Information actively and knowingly provided (e.g., account details, form submissions, uploaded content).
- Observed data: Data generated by the data subject's activity (e.g., search history, location data, activity logs, raw sensor data from connected devices).
- NOT included — Inferred or derived data: Data created by the controller through analysis (e.g., credit scores, profiling segments, algorithmic assessments). These are the controller's intellectual output.
Legal Basis Filter
Portability applies ONLY where the legal basis for processing is:
- Art. 6(1)(a) — Consent
- Art. 9(2)(a) — Explicit consent (for special category data)
- Art. 6(1)(b) — Performance of a contract
Portability does NOT apply to data processed under:
