A portability export needs a field-by-field scope decision

One download button can combine different rights

An account export contains form entries, raw activity events, an internally inferred score and comments about other people. The engineer can serialize every field into JSON, but the privacy owner still needs to decide which right and scope the response addresses. Technical completeness and the correct legal response are different tests.

EU GDPR Article 20 concerns personal data provided by the individual, with the consent-or-contract and automated-processing conditions stated there. It includes a technically feasible direct-transfer right and protects other people’s rights and freedoms. The EDPB small-business guide explains that provided data includes observed behaviour, while data the organisation creates on that basis is different.

A completed field decision for a fictional portal

Hypothetical example: an individual uses a fictional equipment-service portal. Assume the relevant processing is automated and based on the qualifying consent or contract ground. The person asks for portability of their data. No real customer record or export has been obtained.

The privacy owner completes the table below before choosing a delivery format. Each row preserves why the field is included, outside this particular portability analysis or still requires review. This does not decide the scope of a separate access request or eliminate other obligations.

Keep meaning with the exported fields

The EDPB guide describes structured, commonly used and machine-readable formats, with metadata needed for reuse. JSON, XML and CSV are examples; selecting one does not by itself preserve meaning. A timestamp without a time basis or a code without its mapping can make an otherwise parseable response hard to use.

For the fictional portal, the output specification therefore includes field names, type/units, event-time interpretation and the relevant code definitions. It identifies observed events separately from the excluded inferred-score field. Keep the reason for that distinction, rather than silently dropping the field from every other request process.

The direct-transmission option remains conditional on technical feasibility, and Article 20 preserves other rights and freedoms. Do not transform a field-level review into an instruction to disclose another person’s narrative unchanged. Where information is mixed, preserve the exact issue for the responsible reviewer rather than promising that every complete database row must be sent.

A portability response also does not necessarily mean the controller should delete its source record. Article 20 is without prejudice to the separate erasure right. Record a distinct erasure request and its applicable handling instead of attaching a delete-all action to the export button.

Do not carry portability into an unrelated license

The individual’s right to obtain or transmit qualifying personal data does not establish every permission a commercial recipient might want. A new controller’s proposed purpose, lawful basis and other requirements need their own assessment. An exported field is not a transferable warranty of unrestricted reuse.

In the hypothetical case, the useful deliverables are the scoped field matrix, a reusable-format specification and an accurate response record. The table does not approve a company to market the resulting account package as data inventory.

Use inventory to retain the field origins and rights review for the actual recipient and purpose. The separate identity-check article concerns who is making the request; this article concerns what this particular right reaches. A VOID referral does not implement a portability request or supply the new recipient’s privacy permissions.