Art.20 Right to data portability
Where processing is based on consent or on a contract and is carried out by automated means, provide the personal data the data subject has provided to the controller in a structured, commonly used and machine-readable f
4
artefacts
3
held by a system
1
at each review
easy
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Identification of which datasets are in scope, being data provided by the data subject under consent or contract and processed by automated means · Vendor register / contract repository
- The export format and a sample export, showing it is structured and machine-readable rather than a rendered document · Data governance / DLP tooling
- The rule applied for excluding data about other people from an export, and evidence it was applied · Data governance / DLP tooling
periodic reviewEvidence produced at each review
- The direct controller to controller transmission capability where one exists, and the technical feasibility assessment where it does not · Data governance / DLP tooling
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Data governance / DLP tooling. DLP policy hits, retention job logs and disposal certificates from the tooling.
Common gaps auditors find
- A rendered document or a printed screen supplied and described as a machine-readable format
- Observed data such as usage history and device telemetry excluded on the view that only typed form fields were provided by the data subject
- Portability conflated with access, so the response is an access pack rather than a reusable dataset
- Export delayed or made difficult to discourage switching, which is the hindrance the Article prohibits
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.19 Notification obligation regarding rectification, erasure or restriction · Art.21 Right to object