# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 20** — Right to data portability
- **Article 6(1)(a)** — Consent as legal basis (triggers portability eligibility)
- **Article 6(1)(b)** — Contract as legal basis (triggers portability eligibility)
- **Article 9(2)(a)** — Explicit consent for special category data
- **Article 12** — Transparent communication and modalities
- **Recital 68** — Elaborates on the right to data portability and the obligation to provide data in a commonly used format

### UK Data Protection Act 2018
- **Section 18** — Right to data portability (supplements Art. 20 in UK context)

## Regulatory Guidance

### European Data Protection Board (EDPB) / Article 29 Working Party
- **Guidelines on the right to data portability (WP242 rev.01)** (adopted 5 April 2017): Definitive guidance on the scope of portable data (provided vs. observed vs. inferred), applicable legal bases, machine-readable format requirements, and technical implementation.
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): Clarifies the relationship between the right of access (Art. 15) and the right to portability (Art. 20).

### Information Commissioner's Office (ICO) — United Kingdom
- **Right to data portability guidance** (updated 2024): Practical guidance on handling portability requests under UK GDPR, including format requirements and common scenarios.

## Technical Standards

### RFC 4180 — Common Format and MIME Type for CSV Files
- Specifies the standard format for CSV files used in data portability exports: CRLF line endings, double-quote escaping, header row conventions.

### RFC 8259 — The JavaScript Object Notation (JSON) Data Interchange Format
- Specifies the JSON format used as the default export format for portability responses.

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3.7** — Right to data portability: establishes controls for implementing portability within a Privacy Information Management System.

### W3C Data on the Web Best Practices
- Guidance on publishing structured data in reusable formats, applicable to machine-readable portability exports.