Fundamentals
Personal Data Portability: What It Is and Its Limits
6 min read1,225 words
Share
In this article · 7 sections
Data portability can let people receive certain personal data in a reusable format and, in some cases, move it to another provider. Its scope depends on the law, technology, and the rights of others.
Changing providers can seem straightforward until an uncomfortable question arises: what happens to the information accumulated over years? Photos, contacts, or activity records may remain locked inside a service, even when the person generated them.
Personal data portability aims to reduce some of that dependency. Where applicable law recognizes the right and its conditions are met, a person may receive certain data in a reusable format and, in some circumstances, ask for it to be transmitted to another controller.
This does not mean that an entire account can be moved with one click, nor does it turn every piece of information connected to a person into that person's absolute property. What matters is what is requested, how it was obtained, and which law governs the case.
Key idea: Porting data does not mean moving a whole account; it means obtaining certain data under conditions that make it easier to reuse or transmit.
What does it mean to port personal data?
Under the European Union's General Data Protection Regulation (GDPR), a person has the right to receive the personal data they have provided to a controller in a structured, commonly used, machine-readable format. They may also transmit that data to another controller without the first controller obstructing them. Where technically feasible, they may request a direct transmission between the two.
A PDF that can only be read does not always fulfill the practical purpose of the right. Formats such as CSV or JSON may allow another system to process the fields, but they do not guarantee that a new provider can import them without adaptation.
Recital 68 of the GDPR encourages interoperable formats, but does not by itself require providers to maintain compatible systems. It is useful to distinguish between:
- Receiving a reusable copy.
- Requesting a direct transmission, where technically feasible.
- Migrating a service in full, which the right does not guarantee.
Which data may be included?
The answer depends on the applicable law. Under the European interpretation, data “provided” by an individual are not limited to information knowingly entered into a form. They may also include information observed through use of a service or device.
Consider a fitness app. The name, age, or goals entered by the person are data provided directly. Step counts, routes, or heart-rate records captured during use are observed data. Both groups may fall within European data portability if the other conditions are met.
By contrast, a risk profile or an algorithmic recommendation produced by analyzing those records is inferred data. Under the European model, it will generally not be part of the portable data set, although other rights may permit information about its processing to be obtained.
There may also be third-party data, such as messages or contacts. Their presence does not automatically rule out portability, but the recipient cannot use another person's information for any purpose whatsoever: it needs a valid legal basis and must respect that person's privacy rights.
Useful distinction: A usage history may be portable; a predictive profile created from that history generally is not under the European approach.
When can this right be exercised?
Article 20 of the GDPR sets cumulative conditions. Under that regime, portability applies where processing:
- is based on the person's consent or on a contract; and
- is carried out by automated means.
It does not apply in the same way to processing necessary for the performance of a task in the public interest or for the exercise of official authority. Its exercise must also not adversely affect the rights and freedoms of others.
These rules are not universal. Mexico, for example, provides in Article 51 of its Federal Law on the Protection of Personal Data Held by Private Parties for a structured electronic copy and, under certain conditions, its transmission to another system. This is a jurisdictional comparison, not an extension of the GDPR to Latin America.
Before making a request, it is worth checking the applicable law, identifying the controller, defining the data sought, and finding out which channel the service offers.
Data portability, access rights, and number portability are not the same
The right of access lets someone know whether an organization processes their personal data, obtain a copy, and learn information about that processing. Its central purpose is transparency.
Data portability is intended to make certain data reusable or transferable in a processable format. It may cover a smaller subset of data and require additional conditions.
Number portability, by contrast, lets a person keep a telephone number when changing operators. Although it shares the aim of reducing obstacles to switching, it belongs to telecommunications regulation and is not equivalent to the general right relating to personal data.
Nor should portability be confused with erasure. Receiving or transmitting data does not automatically remove it from the original provider. If a person wants it deleted, they must separately consider whether they can exercise a right to erasure and which legal obligations justify the provider's retention of it.
A practical example and its limits
Suppose a person wants to move from one fitness platform to another. They could request the data they entered and the records collected during use, and ask for a structured file. If the legal conditions are met and the systems allow it, they might also request that it be sent directly to the new provider.
The first platform would not necessarily have to provide the profile produced through its own analysis. The second might not recognize every field. And any information about third parties would remain subject to its own limits.
The controller may verify the person's identity and secure the transfer. Security prevents fraudulent disclosures, but it should not become an arbitrary barrier.
In practice: A portable file can reduce the friction of switching, but it does not ensure that a new service will reproduce every feature, classification, or result of the old one.
More ability to choose, not absolute control
Portability can strengthen individual autonomy: it lets people take part of their digital history with them and lowers some switching costs. In markets where users can leave more easily, competition among providers may encourage them to compete on quality, price, and trust.
That effect is not automatic. Incompatibility, concentration, or a lack of alternatives may limit it. Even so, separating reusable data from the service creates room for choice and innovation.
The best way to understand this right, then, is as a concrete and limited tool. It gives a person some control over personal data, while coexisting with security, the controller's obligations, and the rights of others. To exercise it with realistic expectations, check the local rule and ask not only, “Can I download my data?” but also, “In what format, with what scope, and for what purposes can it be reused?”