Data Portability
Definition
A consumer's right to receive their personal data from a business in a portable, structured, commonly used, and machine-readable format so it can be moved to another service provider. In US state privacy laws, data portability usually travels with the right of access: the consumer asks for a copy of the data they provided, and the business exports it in a format that another system can reasonably reuse.
Legal Definition
Under the CCPA/CPRA (Cal. Civ. Code 1798.130(a)(3)(B)(iii)), businesses must provide the specific pieces of personal information in an easily understandable format and, where technically feasible, in a structured, commonly used, machine-readable format that can be transmitted to another entity without hindrance. Under the VCDPA (Va. Code 59.1-577(A)(4)), consumers may obtain a copy of personal data they previously provided to the controller in a portable and readily usable format when processing is automated.
State Laws Using This Term
Practical Example
A user wants to switch from one fitness app to another. They request their account profile, workout history, wearable-device readings, and subscription records in CSV or JSON, rather than a screenshot or locked PDF, so the information can be imported into a new service.
Data Portability Rules Compared
The wording varies by state, but the practical compliance target is the same: a reusable export, not a human-only summary.
| Law | What must be portable | Format rule | Important limit |
|---|---|---|---|
| California CCPA/CPRA | Specific pieces of personal information collected about the consumer. | Readable to the average consumer and, where technically feasible, structured, commonly used, and machine-readable. | Does not require disclosure of security-and-integrity data or trade secrets. |
| Virginia VCDPA | Personal data the consumer previously provided to the controller. | Portable, technically feasible, readily usable, and transferable without hindrance. | Applies where the processing is carried out by automated means. |
| Colorado CPA Rules | Personal data collected and maintained about the consumer. | Secure transfer in a commonly used electronic format that is readily usable. | Controllers provide as much portable data as possible without disclosing trade secrets. |
Business Implementation Checklist
- Offer CSV or JSON exports for account, transaction, preference, device, and uploaded-content records whenever those categories are technically separable.
- Do not treat a PDF letter, screenshot, or privacy-policy summary as enough when the consumer asked for portable data that another service can reuse.
- Keep authentication proportional to the sensitivity of the export, and document any category withheld because it would expose trade secrets, security logs, or another person's data.
- Pair the export workflow with DSAR deadlines: most state privacy laws require an initial response within 45 days, with one extension when reasonably necessary.
Primary Sources
- California Civil Code § 1798.130 (date_retrieved: 2026-05-24)
- Virginia Code § 59.1-577 (date_retrieved: 2026-05-24)
- Colorado Attorney General CPA FAQ (date_retrieved: 2026-05-24)
Related Terms
Frequently Asked Questions
What is the definition of data portability?
Data portability is the right to receive a reusable copy of personal data in a format another system can process. In privacy-law practice, it means the business should provide the consumer's data in a structured electronic format such as CSV, JSON, or XML when technically feasible, rather than only a narrative summary.
What format must portable data be provided in?
Most laws require a portable, readily usable, commonly used, or machine-readable format. In practice, that usually means CSV, JSON, XML, or another documented export format. The format should let the consumer transmit the data to another controller without unnecessary friction.
Is data portability the same as right of access?
No. The right of access tells the consumer what data the business has. Data portability is the export layer: when the consumer receives the copy, the data should be usable outside the original business's system. Many US state laws combine the two rights in the same DSAR workflow.
Does data portability require businesses to reveal trade secrets?
Generally no. State privacy laws and rules usually let businesses withhold or limit exports when disclosure would reveal trade secrets, security-and-integrity data, another person's data, or information the business cannot provide after reasonable authentication.