What evidence do auditors commonly ask for on Art.20 Right to data portability?

Identification of which datasets are in scope, being data provided by the data subject under consent or contract and processed by automated means; The export format and a sample export, showing it is structured and machine-readable rather than a rendered document; The direct controller to controller transmission capability where one exists, and the technical feasibility assessment where it does not; The rule applied for excluding data about other people from an export, and evidence it was applied.

What is the most common gap auditors find on Art.20?

A rendered document or a printed screen supplied and described as a machine-readable format

GDPR · Chapter III - Rights of the Data Subject

`Art.20` Right to data portability

Where processing is based on consent or on a contract and is carried out by automated means, provide the personal data the data subject has provided to the controller in a structured, commonly used and machine-readable format, and do not hinder its transmission to another controller. Where technically feasible, transmit the data directly from one controller to another at the data subject's request. The right is without prejudice to the right to erasure, does not apply to processing necessary for the performance of a public interest task or the exercise of official authority, and must not adversely affect the rights and freedoms of others.

Source: GDPR, Art.20. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

easy

to go live

Data governance / DLP tooling

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

The export format and a sample export, showing it is structured and machine-readable rather than a rendered document · Data governance / DLP tooling
The rule applied for excluding data about other people from an export, and evidence it was applied · Data governance / DLP tooling

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Identification of which datasets are in scope, being data provided by the data subject under consent or contract and processed by automated means · Vendor register / contract repository
The direct controller to controller transmission capability where one exists, and the technical feasibility assessment where it does not · Policy repository / GRC workspace

First move

Automate the pull from your Data governance / DLP tooling. DLP policy hits, retention job logs and disposal certificates from the tooling.

Common gaps auditors find

A rendered document or a printed screen supplied and described as a machine-readable format
Observed data such as usage history and device telemetry excluded on the view that only typed form fields were provided by the data subject
Portability conflated with access, so the response is an access pack rather than a reusable dataset
Export delayed or made difficult to discourage switching, which is the hindrance the Article prohibits

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.19 Notification obligation regarding rectification, erasure or restriction · Art.21 Right to object