[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F20":3},{"item":4,"lessons":16,"controls":26,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","20","Article 20","Right to data portability",2,"General Data Protection Regulation","**What it asks for.** Where processing is based on consent or a contract and carried out by automated means, individuals can receive the personal data they provided to a controller in a structured, commonly used and machine-readable format, and transmit it to another controller. Where technically feasible, they can have it sent directly from one controller to another.\n\n**In practice.** Organisations identify which processing activities fall in scope and build an export that includes data actively provided and data observed through use of the service, in formats such as JSON or CSV. Requests are verified, handled within the Article 12 timescale and logged. The export should exclude data that would adversely affect the rights of others, and portability does not remove the right to erasure. Evidence includes a documented procedure, a sample export file and the request log.\n\n**Common gaps.** Common gaps are exports as PDF or screenshots that are not machine-readable, exports that omit observed data, and no clear mapping of which processing relies on consent or contract.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_20","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"meta-fined-12m-for-failing-gdpr-data-access-portability-obligations","Meta Fined €1.2M for Failing GDPR Data Access & Portability Obligations","2026-08-26T12:21:55.32+00:00",{"slug":23,"title":24,"published_at":25},"irish-high-court-upholds-dpc-authority-to-address-systemic-data-issues-from-individual-complaints","Irish High Court Upholds DPC Authority to Address Systemic Data Issues From Individual Complaints","2026-08-26T10:20:54.906+00:00",[27,32],{"slug":28,"name":29,"problem":30,"stories":31},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":33,"name":34,"problem":35,"stories":31},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[37,42,46,51,55,59,63,67],{"family":38,"item":39,"code":40,"title":41,"together":9},"cis","3","Control 3","Data Protection",{"family":5,"item":43,"code":44,"title":45,"together":9},"15","Article 15","Right of access by the data subject",{"family":47,"item":48,"code":49,"title":50,"together":9},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":52,"item":53,"code":54,"title":54,"together":9},"itil","overview","ITIL",{"family":56,"item":53,"code":57,"title":58,"together":9},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":5,"item":60,"code":61,"title":62,"together":9},"83","Article 83","General conditions for imposing administrative fines",{"family":5,"item":64,"code":65,"title":66,"together":31},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":5,"item":68,"code":69,"title":70,"together":31},"57","Article 57(4)","Tasks"]