Data portability rights let you obtain a copy of the personal information a company holds about you, in a format you can actually use or move to another service. In the United States, more than 20 states have enacted comprehensive privacy laws that include some version of this right, and the EU’s General Data Protection Regulation has required it since 2018. Sector-specific rules cover financial accounts and health records separately. The mechanics vary by law, but the core is consistent: you ask, the company verifies who you are, and it delivers your data within a legal deadline.
What Data You Can Request
Portability applies to personal information you provided to a company or that it collected through your direct use of its service. Account details, contact lists, uploaded photos, purchase histories, and message logs all sit squarely within scope. Under the GDPR, the right covers data you provided to a controller where the processing is based on your consent or a contract and is carried out by automated means.1General Data Protection Regulation (GDPR). GDPR Article 20 – Right to Data Portability
Data a company generated through its own analysis of your behavior falls outside the right. Internal credit scores, risk assessments, and algorithmic profiles the company built for its own business purposes are not yours to port. The line runs between information you actively handed over (or that was directly observed from your activity) and conclusions the company drew from that information using its own methods.
Third-Party Information in Your Archive
Your data will often contain information about other people. Group chat messages, shared photos, and contact lists all involve third parties. The GDPR addresses this directly: the right to portability “shall not adversely affect the rights and freedoms of others.”1General Data Protection Regulation (GDPR). GDPR Article 20 – Right to Data Portability Companies can include third-party data in the download for your personal use, but you can’t upload it to a new platform in ways that violate those other people’s privacy.
How Far Back You Can Go
Under the CCPA, the right to access and port your data covers personal information collected during the 12 months before your request, and California residents can make these requests up to twice per year, free of charge.2California Privacy Protection Agency. Frequently Asked Questions The GDPR imposes no similar lookback, so EU residents can request their full history with a company.
Which Laws Give You the Right
Portability is not a single law. It’s a right that appears across a patchwork of regulations, and the version you can exercise depends on where you live and what kind of data you want.
The GDPR
Article 20 of the GDPR is the most established portability right. It requires companies to provide personal data in a “structured, commonly used and machine-readable format” and lets you request direct transfer to another company when technically feasible.1General Data Protection Regulation (GDPR). GDPR Article 20 – Right to Data Portability Violations of data subject rights carry administrative fines of up to €20 million or 4% of worldwide annual revenue, whichever is higher.
U.S. State Privacy Laws
California led with the CCPA in 2020, and the California Privacy Rights Act strengthened those protections. As of 2026, more than 20 states have comprehensive privacy laws with a portability component, including Virginia, Colorado, Connecticut, Texas, Oregon, Indiana, Kentucky, and Maryland. Details differ, but the mechanism is similar: you submit a request, the company verifies your identity, and it delivers your data in a usable format. California’s regime includes administrative fines of up to $2,663 per violation, or up to $7,988 per intentional violation and violations involving data of consumers under 16.3California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties
Financial Accounts Under CFPB Rule 1033
The Consumer Financial Protection Bureau finalized its Personal Financial Data Rights rule in October 2024. Banks and other financial institutions must make covered data available to you electronically on request.4Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights Covered data includes at least 24 months of transaction history (amounts, dates, payment types, merchant names, fees, and rewards credits), current account balances, account and routing numbers for initiating transfers, terms and conditions including fee schedules and interest rates, upcoming bill payment information, and basic account verification details tied to the account.5eCFR. Personal Financial Data Rights
Health Records Under HIPAA
HIPAA gives you the right to obtain copies of your protected health information from any covered entity, including hospitals, clinics, and health insurers. If you request an electronic copy and the provider keeps your records electronically, they must supply it in the electronic format you request when they can readily produce it, or in another readable electronic format you both agree on. Providers must act within 30 days, with one possible 30-day extension if they notify you in writing with a reason.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information They can charge a reasonable, cost-based fee covering only labor for copying, supplies for any physical media, and postage. Search-and-retrieval charges and general administrative overhead are not permitted.
Federal Backstop
No single federal statute covers portability across all sectors. The FTC can act against companies engaged in unfair or deceptive practices under Section 5 of the FTC Act, which reaches misleading consumers about their data access rights.7Federal Trade Commission. Privacy and Security Enforcement
How to Submit a Request
Before you start, gather the email addresses and usernames tied to your accounts, and decide what data you actually want. Most large platforms have a self-service tool in their privacy or security settings. Google calls it Takeout, Facebook labels it Download Your Information, and Apple puts it on a Data and Privacy page. These tools let you pick everything or specific categories like photos, messages, or purchases. Be specific when you can, because requesting the full history of a decade-old account generates an enormous archive.
If there’s no self-service option, send a written request to the company’s privacy team or data protection officer. Privacy policies are legally required to include the contact information. Companies must verify your identity before releasing anything, usually through a verification email or multi-factor authentication. Some ask for government-issued ID, more often for formal written requests than for self-service downloads.8State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Deadlines and Fees
Once a company has your verified request, the clock starts. Under the GDPR, it has one month to respond, extendable by up to two additional months for complex requests if it notifies you within the first month. Under the CCPA, companies get 45 calendar days, with a possible 45-day extension for a total of 90 days if they notify you of the reason.8State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Standard requests under the CCPA and GDPR must be fulfilled free of charge. California guarantees two free requests per year.2California Privacy Protection Agency. Frequently Asked Questions The GDPR allows a reasonable fee only for requests that are “manifestly unfounded or excessive,” particularly repetitive ones. When processing is complete, you’ll usually get a secure, time-limited download link. These often expire within a few days to a week, so don’t let the email sit.
Formats and Direct Transfers
The law requires companies to deliver data in a structured, commonly used, and machine-readable format.1General Data Protection Regulation (GDPR). GDPR Article 20 – Right to Data Portability Three formats dominate in practice:
- JSON, common for complex data like social media activity, app usage, and nested records. A text editor or JSON viewer will open it.
- CSV, used for simpler tabular data like contact lists and transaction logs. Opens in Excel or Google Sheets.
- XML, a structured format that defines data types for both humans and software, though less common in consumer downloads than JSON or CSV.
The GDPR encourages controllers to develop interoperable formats but does not require companies to adopt processing systems technically compatible with competitors.9General Data Protection Regulation (GDPR). Recital 68 – Right of Data Portability Interoperability is aspirational, not mandatory.
The GDPR also gives you the right to have data transmitted directly from one controller to another where technically feasible.1General Data Protection Regulation (GDPR). GDPR Article 20 – Right to Data Portability The Data Transfer Project, launched in 2018, powers direct transfer features inside Google Takeout, Facebook’s Transfer Your Information tool, and Apple’s Data and Privacy page, with software libraries connecting to over a dozen additional services.10Data Transfer Initiative. Data Transfer Initiative When direct transfer is available, use it. It eliminates downloading a multi-gigabyte archive and uploading it manually. When direct transfer isn’t available, check the destination service’s import capabilities before investing time in a large export. Not every platform accepts imports, and those that do may only support certain data types.
If Your Request Is Denied or Ignored
If a company misses the legal deadline or rejects your request without a clear explanation, start by escalating in writing. Reference the specific law, the date of your original request, and the deadline they missed. Keep copies of everything.
If that fails, the next step depends on jurisdiction. In the EU, file a complaint with your national data protection authority. In the United States, the relevant regulator is usually your state attorney general’s office, and most states have online complaint portals. California residents can also file directly with the California Privacy Protection Agency.
There is no general private right of action for portability violations under the CCPA. The private lawsuit provision is limited to data breaches involving unauthorized access to unencrypted personal information. Enforcement for ignored portability requests runs through regulators, which is why documenting your request timeline matters.
Protecting the Data After You Download It
A data archive sitting on your laptop is a security liability. These files can contain your full name, email addresses, financial transactions, private messages, and potentially authentication tokens. A few precautions help:
- Download on a trusted network rather than public Wi-Fi. The link is encrypted, but minimizing exposure is basic hygiene.
- Store the archive on an encrypted drive or inside a password-protected compressed file. An unencrypted JSON dump in your Downloads folder is a target.
- Delete the raw archive once you’ve imported what you needed. There’s no reason to keep a full copy of your social media history on an unprotected device indefinitely.
- Watch for phishing after you submit a request. Legitimate download notifications will come from the platform’s actual domain; attackers know the pattern and send convincing fakes.
The right to portability is only as useful as your ability to handle the data safely once you have it. Companies must deliver it securely; after that, the responsibility is yours.