In short. An online shop must provide portable customer data on request when Article 20’s conditions on the data, legal basis and automated processing are met.
Definition: Under GDPR Article 20, an online shop must fulfil a customer's portability request for personal data concerning that customer which the customer has provided, where processing is automated and based on consent or a contract. The customer has the right to receive those data in a structured, commonly used and machine-readable format and transmit them to another controller.
Key facts
- GDPR Article 20(1) requires both a qualifying legal basis and automated processing.
- The Article 29 Working Party's portability guidelines give titles bought from an online bookstore as an example generally covered through contractual processing.
- As of October 2026, the European Data Protection Board's small business guidance identifies XML, JSON and CSV as suitable common formats and requires accompanying metadata for reuse.
Which processing qualifies?
Under GDPR Article 4(7), a controller is the organisation that determines the purposes and means of processing personal data. For a shop acting as controller, a legal basis is the ground that permits a particular processing operation. GDPR Article 20(1)(a) covers consent under Article 6(1)(a), explicit consent under Article 9(2)(a), and contractual processing under Article 6(1)(b).
Article 6(1)(b) concerns processing necessary to perform a contract with the individual or take steps at that individual's request before entering a contract. Holding a customer account alone therefore does not settle which processing qualifies. Article 20 also requires automated processing. Processing based solely on a legal obligation or legitimate interests falls outside these qualifying bases.
Which customer data are included?
The portability guidelines interpret data the customer has provided to include both information submitted through online forms, such as a mailing address, and observed activity, such as website usage history. These categories remain subject to the legal-basis and automation conditions.
The same guidelines exclude data inferred or derived by the controller, including profiles created through personalisation or recommendation processes. Article 20 concerns personal data about the requesting individual; under Article 20(4), exercising portability must also respect other people's rights and freedoms.
How must the shop supply the data?
GDPR Article 20(1) requires a structured, commonly used and machine-readable format and transmission without hindrance. Article 20(2) also gives the customer a right to direct transmission between controllers where technically feasible.
The EDPB's small business guidance says the format must allow reuse in another service. Metadata, meaning information that describes the exported data, must accompany the export so it can be used on another platform. The guidance states that a PDF is insufficient. Where direct transfer is technically impossible, its webmail example requires a reusable digital copy for the customer.
Under Article 12(3), the shop must provide information on action taken without undue delay and within one month of receiving the request. Complexity and the number of requests can justify two further months, with notice and reasons within the initial month. Article 12(6) permits additional information necessary to confirm identity where reasonable doubts exist.
Related terms
- GDPR lawful basis for web data
- What must a website provide in an Article 15 access response?
- How long does a website have to answer a GDPR rights request?
FAQ
Can the shop charge me for the export?
Under GDPR Article 12(5), actions on rights requests are free of charge. For a manifestly unfounded or excessive request, the controller may charge a reasonable administrative fee or refuse to act, and bears the burden of demonstrating that character.
Does portability erase my shop account data?
The portability guidelines explain that portability does not automatically erase data or change the applicable retention period. You can continue using the service after a portability operation.
Sources
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
- Article 29 Working Party, "Guidelines on the right to data portability", revised 5 April 2017
- European Data Protection Board, "Respect individuals' rights", undated
Check how a page reads to answer engines. Open the GEO score analyzer