Data portability
In short. Data portability is the ability to obtain your data from one service in a structured, commonly used, machine-readable format and move it to another. Under UK and EU data protection law, individuals have a right to this for personal data they provided, in defined circumstances.
Last checked against its sources on 10 October 2026. How we write these.
For a business, portability works in two directions. As a customer of software suppliers, you want to be able to take your records with you. As a holder of personal data, you may have to give individuals a copy of what they supplied to you.
The UK Information Commissioner's Office explains that the right applies when the lawful basis for processing is consent or performance of a contract, and the processing is carried out by automated means. The data should be provided in a structured, commonly used and machine-readable format, with CSV, XML and JSON given as examples.
In most cases no fee can be charged, and a response is due without undue delay and within one month, which can be extended by two further months for complex or multiple requests, if the person is told within the first month.
Practically, this means knowing where personal data lives and being able to export it. A small online shop should be able to produce a customer's order history as a file. The same discipline protects the business against supplier lock-in, because it can leave a platform with its data intact.
Questions people ask
Does data portability apply to business data?
The legal right covers personal data of individuals. Businesses should still seek contract terms that allow export of their own data from suppliers.
What formats count as machine-readable?
The ICO gives CSV, XML and JSON as examples of suitable open formats.
Sources
- ICO: Right to data portability checked 10 October 2026