GDPR Article 20 requires personal data to be given in a structured, commonly used and machine-readable format, for data the person provided, where processing rests on consent or a contract and runs by automated means. JSON and CSV usually satisfy this. The hard part is scope, not syntax.
What the article says
Article 20(1) gives a data subject the right to receive their personal data "in a structured, commonly used and machine-readable format" and to transmit it to another controller. Paragraph 1 limits the right to processing based on consent or a contract, and to processing carried out by automated means. Paragraph 4 says the right must not adversely affect the rights and freedoms of others.
What to include
The article refers to data the person has provided. In practice that means data they entered or generated by using your service, such as profile fields, uploaded content, messages they wrote and activity records. Regulators have generally read this to include observed data such as usage logs, but not conclusions you inferred, like internal scores. Confirm the current guidance from your supervisory authority and counsel for edge cases.
Build the export from a documented list of fields, tied to your data map, not from a dump of tables. A list lets you explain what is covered and what is not.
Choosing a format
- JSON. Good for nested data like profiles with addresses and settings. Easy for developers to parse, easy to import elsewhere.
- CSV. Good for flat tabular data such as order history. Opens in a spreadsheet, which many people expect.
- Standard domain formats. Calendars, contacts and similar data have established formats, such as iCalendar and vCard. Use them where they exist.
- PDF alone. Readable by people but not machine readable in the sense of Article 20. Offer it only as a companion summary.
- Proprietary binary. Avoid.
Pick one primary format per data type, document the schema, and ship a short readme describing each file and field.
Practical details
- Use UTF-8 and ISO 8601 timestamps with time zones.
- Include stable IDs so related files can be joined.
- Store attachments as original files, not re-encoded versions.
- Keep the package self contained in a zip file.
- Provide it through an expiring, authenticated link.
Protect others
Messages and shared documents may contain other people's data. Redact or exclude what would harm them, as paragraph 4 asks. A review step in your pipeline is the place for this.
Direct transfer
Article 20 also covers transmission to another controller where technically feasible. Support that only if you can do it safely, for example through an authenticated API or a signed export the person uploads themselves.
Quick check
Does portability cover all personal data I hold?
No. It covers data the person provided, under consent or a contract, processed by automated means. The access right in Article 15 is broader.
Is a PDF export acceptable?
Not on its own. The format must be machine readable, so supply JSON or CSV as well.
Sources
Last reviewed: 19 October 2026.
