What the right to data portability is
The right to data portability lets the subject take their own data along when moving from one service to another. Under Article 18 of the Law on Personal Data Protection, in the case of automated processing based on the grounds provided by law, where technically possible, the subject has the right to receive from the controller, in a structured, commonly used and machine-readable format, the data provided by them, or to demand their transfer to another controller.
On which grounds it works
The portability right is tied to subpoints (a) and (b) of point 1 of Article 5 — the subject's consent, and the performance of a contractual obligation or the conclusion of a transaction at the subject's request — and, for special categories of data, to written consent. It must be said plainly: the Georgian portability right is by its essence narrower than the corresponding institute described in Europe's General Data Protection Regulation — no portability right is provided for processing based on public interest, statutory duty or legitimate interest. Each request therefore begins with establishing the ground, and only then the format. Point 2 of Article 5 puts the substantiation of the legal basis on the controller itself — the ground's existence is confirmed by the organization, not the subject.
The format and direct transmission
The law names two paths: the subject receives the data in a structured, commonly used and machine-readable format — not a mere picture of a document but a form readable in another system — or demands direct transmission of the data to another controller where technically possible. Only the data the subject supplied themselves must be provided — the controller's conclusions and profiles are not the object of this right.
Portability versus access — what differs
Portability is often confused with the right of access, but the aim differs. The right of access lets the subject examine the data concerning them and obtain copies — to know what the organization holds. The aim of portability is use: the received data must work in another service — hence the mandatory machine-readable format. Access is thus an instrument of knowledge, portability one of transition. In practice both requests may be submitted together, but the controller processes them differently: for access, a statutory fee may apply to a different format, while for portability no fee is provided — rights operating on consent and contract grounds are exercised free of charge.
Submitting a request, information and dispute resolution
When submitting, the subject should first define which data they need and where they are going — this speeds up the process. On the organization's side, three elements are decisive: first, determine which processing serves consent or a contract and thus falls within portability's scope; second, technically prepare export in a structured format and consider the possibility of direct transmission to another controller; third, reflect the process in information duties so the subject knows the right exists.
Under subpoint (d) of point 1 of Article 13, the right to information covers information about the subject's rights under this chapter — so an organization must proactively inform the subject of the portability right, and this information is supplied free of charge corresponding to the request. The period is fixed: under point 2 of the same article, the information is provided to the subject no later than 10 working days from the request; in special cases the period may, with appropriate substantiation, be extended by no more than 10 working days, of which the subject must be notified immediately. The subject may choose the form of provision; where another form is not requested, it is provided in the form of the request.
On refusal or delay, the subject applies under Article 22 to the State Audit Service, the court or a superior organ. Under the same article, the subject may demand from the State Audit Service a blocking decision before the completion of the review, and the Service's decision is appealed in court under the conditions and periods provided by Georgian legislation. A subject leaving one service often simultaneously requests information about the processing and withdrawal of consent — such requests must be answered together, yet each under its own right's rules. Where the portability request demands direct transmission, the organizations should document their technical-feasibility assessment in writing — later, in a dispute, that record becomes the decisive evidence.
Frequently Asked Questions
Below — frequently asked questions about portability.
Does portability apply to all processing?
No. It applies only to automated processing based on the subject's consent or a contract — and to special categories with written consent. Portability on public-interest, statutory-duty or legitimate-interest grounds is not provided by law.
In what format must I receive the data?
Structured, commonly used and machine-readable — or demand direct transmission to another controller where technically possible.
Within which period must the answer come?
A request under the right to information is answered no later than 10 working days; in special cases the period may be extended with substantiation by no more than 10 working days.
May I also receive profiles?
No — portability covers only the data the subject supplied; the controller's conclusions and profiles are not the object of this right.
Where do I complain on refusal?
Under Article 22 — to the State Audit Service, the court or a superior administrative organ, in the manner established by law.
How We Help on Legal.ge
The Legal.ge team assists both in framing a portability request and, on the organization's side, in building procedures so that requests are satisfied within the statutory periods and formats.
If a service holds your data in violation of the portability right, or your organization needs a process for answering requests, write to us on Legal.ge — we will assess the grounds, prepare the request and build a substantiated procedure.