In order that the individual may move, copy of transfer their data (also known as data portability) from your organisation to another (or from another organisation to yours), they have the right to request that this be undertaken by the organisation holding the data. You are required to have procedures to enable this to be carried out in an appropriate fashion (see below).
The individual’s right to data portability only applies:
- To such personal data that the individual has provided to the organisation (not that generated as a result of the organisation’s activities with the individual subsequently)
- Where the individual has given consent for such processing or where a contract exists requiring such processing
- Where the processing is carried out using automated means
You must verify the identity of the person making the request, using “Reasonable Means”.
You should respond to a request without delay and at least within one month of receipt.
Personal data provided for this purpose must be in a structured, commonly used and machine readable format. Eg. CSV and XML files.
You may not charge for your time processing this information.
Where it is technically viable, you are required, if the individual has so requested, to transmit the data directly to the receiving organisation.
