How to Exercise the Right
Click here to take me to the templates already!
Under Article 20(1) you can ask a service provider to give you personal data that you have provided to them. You can then reuse this data as you like - including asking other service providers to ingest it.
Under Article 20(2) you can ask a service provider that you have provided personal data to to transmit that personal data directly to another service provider.
There are various ways you can request this, depending upon the service provider you are contacting.
You can download a template letter for sending or emailing here. Service providers should have contact details within their privacy policy (or you can check datarightsfinder.org).
If the service provider has a web portal that you can log into, you may find that they have automatic download (and upload) facilities. These automatic download/upload facilities may or may not provide you exactly the data you have a right to under Article 20 GDPR. It is unlikely that you can facilitate any direct transmission of data between service providers in this way.
Service providers may require you to contact customer services to request your data.
Templates
We have two types of template - letter, and e-mail.
These templates cover three scenarios:
- Contacting a data controller under Article 20(1) to request your data be returned to you
- Contacting a data controller under Article 20(1) to request that they receive your data
- Contacting a data controller under Article 20(2) to request that they facilitate direct transmission of you data to another data controller.
Letters
Letters are available in .docx and .odt format. Click the link in the below table to download.
| Scenario | .docx | .odt |
|---|---|---|
| Article 20(1) to request your data be returned to you | .docx | .odt |
| Article 20(1) to request that they receive your data | .docx | .odt |
| Article 20(2) to request that they facilitate direct transmission | .docx | .odt |
E-mails
Here are suggested body texts for each scenario:
- Article 20(1) to request your data be returned to you
- Article 20(1) to request that they receive your data
- Article 20(2) to request that they facilitate direct transmission
Modify the sections in bold italics.
Article 20(1) to request your data be returned to you
I am writing to exercise my right as a data subject under Article 20(1) of the General Data Protection Regulation (GDPR) 2016/679.
In particular, I ask that you return to me, within 30 days, personal data that I have provided to you (under the processing terms of my explicit consent or as part of a contract). This data should be provided in a structured, commonly used, and machine-readable format (for example, a .csv or JSON file; a PDF or printed documentation is not appropriate).
My personal details, as relates to my interaction with your organisation, are as follows:
Name: [name, if applicable]
Username: [username]
E-mail Address: [email]
Device type: [if applicable]
Any other information: [if applicable]
If you have received this letter and are unsure how to respond to it, please forward it to your Data Protection Officer. If you remain unsure about how to handle this request, please contact the Information Commissioner’s Office on 0303 123 1113, or visit their website at https://ico.org.uk.
Please do not hesitate to contact me should you need further information regarding this request.
I would be grateful if you could reply to me to confirm receipt of the request and also to confirm the preferred method of returning the data to me.
Article 20(1) to request that they receive your data
I am writing to exercise my right as a data subject under Article 20(1) of the General Data Protection Regulation (GDPR) 2016/679.
In particular, I wish to transmit my personal data to you in a structured, commonly used and machine-readable format. This data is in [file format], with [type of information – e.g. step data, search history] within it. I would be happy to provide further details should they be necessary.
I appreciate that Article 20(1) GDPR does not provide details as to how it expects data controllers to receive such data from a data subject. I would be grateful if you could reply to me to confirm receipt of the request and also to confirm whether transmission of the relevant personal data is possible.
If it is not possible, please could you further explain if there are any alternative methods of moving my personal data to your service (for example, through existing APIs).
If it is possible, please could you explain the most secure method for me to transmit this data to you.
If you have received this letter and are unsure how to respond to it, please forward it to your Data Protection Officer. If you remain unsure about how to handle this request, please contact the Information Commissioner’s Office on 0303 123 1113, or visit their website at https://ico.org.uk.
Please do not hesitate to contact me should you need further information regarding this request.
Article 20(2) to request that they facilitate direct transmission
I am writing to exercise my right as a data subject under Article 20(2) of the General Data Protection Regulation (GDPR) 2016/679.
In particular, I wish you to facilitate a direct transmission of that personal data that I have provided to you (under the processing terms of my explicit consent or as part of a contract) to another data controller. This second data controller is [second data controller name].
I appreciate that Article 20(2) GDPR requires the transmission of data only where doing so is technically feasible. I would be grateful if you could reply to me to confirm receipt of the request and also to confirm whether direct transmission of the relevant personal data is technically feasible. If it is not, please could you further explain if there are any alternative methods of moving my personal data between your service and theirs (for example, through existing APIs).
My personal details, as relates to my interaction with your organisation, are as follows:
Name: [name, if applicable]
Username: [username]
E-mail Address: [email]
Device type: [if applicable]
Any other information: [if applicable]
If you have received this letter and are unsure how to respond to it, please forward it to your Data Protection Officer. If you remain unsure about how to handle this request, please contact the Information Commissioner’s Office on 0303 123 1113, or visit their website at https://ico.org.uk.
Please do not hesitate to contact me should you need further information regarding this request.
Page last updated: 17 November 2019