This Flowchart maps out a process for evaluating portability requests that your organisation receives under the UK GDPR. It reflects the requirements in the UK GDPR and the Data Protection Act 2018 (DPA 2018). It should be read in conjunction with Practice Note: How to handle data subject requests and Handling data subject requests—flowchart, which covers requirements common to all data subject requests under the UK GDPR. Data subjects can make a request to an organisation to exercise their right to data portability at any time. This is not, however, an absolute right to transfer data—it only applies where: • the data subject has provided personal data to you • the processing is based on consent or performance of a contract, and • the processing is carried out by automated means See Practice Notes: Rights of data subjects—Right to data portability and Data portability. You must respond to the data subject without undue delay and, in any event, within one month of the latest of: • receiving the request • receiving any identity information