|

The Right to Data Portability: A Growing Challenge for Companies

ByPrivacyiQ

Article 20 of the UK GDPR gives individuals the right to receive and reuse their data. Learn how companies should prepare.

Article 20 of the UK GDPR allows individuals to receive a copy of their personal data in a structured, commonly used, machine-readable format.

This typically applies when:

  • Processing is based on consent or contract
  • The data is processed by automated means

Examples include payroll records, client CRM exports, or user-generated content.

💡 Tip:

Standardise your export processes in advance — scrambling to produce machine-readable files under pressure is where mistakes happen.

Similar Posts

A professional woman in a classroom writing on a whiteboard during a lecture session.
| |

The Right to Rectification: Keeping Employee and Client Data Accurate

ByPrivacyiQ

Under GDPR Article 16, individuals have the right to correct inaccurate personal data. Learn how your company can stay compliant. Under Article 16 of the UK GDPR, individuals have the right to request the correction of inaccurate or incomplete personal data. Common requests include updates to: Companies must respond without undue delay, usually within one…

3 of 5: What Article 22 Says About Automated Decisions — and Why It Matters
|

3 of 5: What Article 22 Says About Automated Decisions — and Why It Matters

ByPrivacyiQ

Article 22 of the UK GDPR restricts fully automated decisions that impact individuals. Understand what this means for AI, recruitment tools, and data-driven profiling. As companies adopt automation in everything from hiring to credit scoring, it’s vital to understand the limits imposed by Article 22 of the UK GDPR. This provision protects individuals from being…

Responding to Data Subject Requests: Timelines and Exceptions
|

Responding to Data Subject Requests: Timelines and Exceptions

ByPrivacyiQ

Companies must respond to GDPR rights requests within strict timeframes. Here’s what counts as a valid request — and when deadlines can be extended. The default timeline to respond to data subject rights requests (access, erasure, objection, etc.) is one calendar month. You may extend this by two months if the request is: But —…

4 of 5: When Can You Use Automated Decision-Making? Legal Bases and Safeguards Explained
|

4 of 5: When Can You Use Automated Decision-Making? Legal Bases and Safeguards Explained

ByPrivacyiQ

UK GDPR Article 22 restricts automated decisions — but there are exceptions. Learn when you can use automation lawfully and what safeguards you must have in place. Article 22 of the UK GDPR generally prohibits companies from making decisions based solely on automated processing that have a significant or legal effect on individuals. However, there…

The Right to Object: When Can a Company Say No?

The Right to Object: When Can a Company Say No?

ByPrivacyiQ

Article 21 of the UK GDPR gives people the right to object to certain types of data processing. Learn how your company should handle objections. Under Article 21, individuals can object to processing based on: Once someone objects, you must stop processing unless you can demonstrate compelling legitimate grounds that override their interests. 💡 Tip:…

Diverse professionals engaged in strategic discussion in a law office setting.

The Right to Be Informed: What Does Transparency Really Mean?

ByPrivacyiQ

The right to be informed (Articles 13 and 14 of the UK GDPR) requires companies to explain how they use personal data. Learn how to comply with transparency obligations. Under Articles 13 and 14 of the UK GDPR, individuals have the right to be informed about how their personal data is collected and used. This…