Data Portability
The right to receive your data in a reusable format and move it to another service. The DPDP Act does not give this right.
Data portability is the right to receive your data in a reusable format and move it to another service. The DPDP Act does not create this right, although GDPR does.
Meaning of Data Portability
GDPR gives data portability. The DPDP Act does not include a standalone portability right, though the right to access information and sector frameworks for data sharing serve some of the same purposes.
Data portability is the idea that a person should be able to take the data she has given a service, receive it in a structured, commonly used and machine-readable format, and transfer it to another provider without hindrance. It is found in Article 20 of the GDPR, which applies where processing is based on consent or contract and is carried out by automated means. The aim is to reduce lock-in and to encourage competition between services.
The DPDP Act 2023 has no equivalent. Chapter III gives the right to information about personal data under Section 11, correction and erasure under Section 12, grievance redressal under Section 13 and nomination under Section 14. None of them requires a fiduciary to hand over data in a portable format or to send it directly to a competitor. Section 11 gives a summary of the data and a list of recipients, which is a narrower right.
Portability can still arise by other routes. The Account Aggregator system regulated by the RBI lets customers share financial data with their consent through licensed intermediaries, and the Consent Manager concept in the DPDP Act itself helps individuals manage consent across fiduciaries. A fiduciary may also offer export tools voluntarily, as many apps do for photos or contacts, and a contract may promise it.
When a customer asks for an export, a fiduciary is not bound by the DPDP Act to supply it as a portability right, but should treat the request carefully: it may be an access request under Section 11, a request to port within a sector scheme, or a request covered by the terms of service. Whatever it supplies must be sent securely to the verified person, as any disclosure is processing that needs reasonable safeguards.
Examples of Data Portability
A user wants to export her music-playlist history to a rival app. Under GDPR she could demand it. Under the DPDP Act she has no such statutory right.
A user wants her playlists to move to a rival app. The service has no duty under the DPDP Act to export, but offers a download of playlists in a common format as a courtesy, delivered after identity verification.
A customer wants to share her bank statements with a lender. She uses the Account Aggregator framework to give consent for the lender to fetch the data directly, which works as a sector-specific portability route.
A company with users in India and Germany builds an export tool for European customers because of GDPR Article 20. It decides to offer the same tool in India, since the cost of running two systems is higher.
Why Data Portability matters
The point matters most for businesses that operate in both India and Europe, or that build products for the EU, UK and India with one privacy programme. A policy written for GDPR may promise portability that Indian law does not require, and a policy written only for India may be missing a feature that European users are legally entitled to.
For individuals, the lack of a statutory right means that moving between services depends on what the provider offers or what sector schemes allow. Switching banks, insurers or health providers is easier where an open data framework exists. Where it does not, users may find that their history stays behind unless the provider chooses to share it.
How it works in practice
- 1Decide your policy: even without a legal duty, offering an export of key user data, such as contacts, posts and order history, builds trust and reduces friction in your support queue.
- 2Treat export requests as access requests where Section 11 applies, and answer with the summary and list of recipients that the Act requires, adding the export if you offer one.
- 3Use a standard format such as CSV or JSON, deliver it only after identity verification, and send it through a secure channel with an expiry on the download link.
- 4If you serve European users, keep a separate GDPR workflow with its own timeline and scope, and make sure product and legal teams know which rules apply to which user group.
- 5For financial data, look at whether the Account Aggregator framework can serve the customer's purpose, and integrate with it where relevant, instead of building a one-off process.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Telling Indian users they have a portability right under the DPDP Act. They do not, although a company may offer one by choice or contract.
Ignoring portability for EU users because the Indian Act lacks it. GDPR can apply to services offered to people in the EU.
Sending exports to an unverified email address, which creates a security incident of its own.
Compliance tips
Check your privacy notice wording so it does not describe a right the DPDP Act does not give.
Make exports secure by default: verification, encryption and short-lived links.
Keep an eye on future Rules, sector regulations and Board guidance, as expectations around data sharing are changing.
Common questions about Data Portability
Does the DPDP Act include data portability?
No. The Act gives rights of access to information, correction and erasure, grievance redressal and nomination, but not a standalone right to receive data in a reusable format or to have it transferred to another provider, as GDPR Article 20 does.
Can I still ask a company for a copy of my data?
You can ask under Section 11 for a summary of your data, the processing and the recipients. Many companies also offer downloads voluntarily. There is no general legal duty under the Act to supply a full machine-readable copy.
Is the Account Aggregator system a portability right?
It works like one for financial data. Under RBI's framework, a customer can consent to share financial information between regulated entities through licensed aggregators. It is a sector scheme rather than a right under the DPDP Act.