Data portability
Data portability is the ability to obtain data from one service in a structured form and use it somewhere else without reconstructing the account by hand. GDPR Article 20 creates a specific legal right for certain data supplied by a data subject and processed by automated means on consent or contract grounds. Practical portability is broader than that legal minimum.
Four levels
| Level | Question |
|---|---|
| Availability | Can the customer obtain an export? |
| Interpretability | Are formats, identifiers, and metadata documented? |
| Importability | Can a realistic destination ingest the records? |
| Continuity | Do permissions, links, history, and recovery survive well enough for the job? |
A downloadable archive may satisfy the first level while failing the other three. Rendered documents can preserve appearance but lose structure; machine-readable records can preserve structure but depend on undocumented identifiers or missing attachments.
Portability by design
A privacy service should:
- document its export schema and version changes
- include attachments and relevant metadata
- preserve stable identifiers where that does not create tracking risk
- provide checksums or counts for completeness testing
- support incremental exports for large accounts
- keep deletion separate from export so a failed migration remains reversible
- test at least one independent importer
Direct service-to-service transfer through an API can reduce user effort, but it also exposes both accounts to another authorization path. An offline export remains an important exit route.
Business significance
Privacy migration and continuity turns portability into an evidence-producing service: export, import, exception report, restore test, and rollback. Privacy trust and governance treats usable exit as protection against provider failure, acquisition, and lock-in.
Portability is therefore not a courtesy feature. It is part of whether a customer can safely rely on a privacy product.