Article 20 of the GDPR entitles data subjects the 'right to data portability':
"The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format..."
Main Things to Know
- You must give individuals a way to request and receive a copy of the information they have given you.
- You must provide the personal data in a structured, commonly used and machine readable form such as CSV.
- Once a rectification request is made you must respond without undue delay and within 30 days.
What you could do to be compliant:
The process for compliance with such requests is more or less identical to the 'Right of Access' requests, which we covered this article here. Our recommendation would be to have such requests going through the same process as the 'right of access' requests as the actions that need taken are identical and it might simplify your process.
Data Portability with Gecko Protect:
The new Gecko Protect add-on offers a feature called Contact Portal, which will offer the student an easy way to access, view and export the personal information you currently store within Gecko. The contact will need to fill out a form and get an email or SMS with a unique and secure link to the portal. They may be required to go through an automated process to confirm their identity via email or SMS, after which they will be able to export their information by clicking the 'Download My Details' button seen in the screenshot below.
Any questions? Feel free to start a live chat with a member of our support team or explore the rest of our academy at your leisure.