If your product stores personal data of people in the EU, Article 20 of the GDPR will sooner or later show up in the backlog as an "export my data" feature. A few points worth getting right:
- Scope: personal data the user provided, processed by automated means on the basis of consent or a contract. "Provided" can include observed data such as activity logs or usage history; data your system infers (scores, predictions) is out.
- Format: structured, commonly used and machine-readable. JSON, CSV and XML are typical, but the regulation doesn't mandate one, and a static image of a profile page won't do.
- No universal compatibility duty: Recital 68 encourages interoperable formats, but you aren't obliged to make your export importable everywhere.
- Third parties: if an export contains other people's data (a shared conversation, for instance), their rights have to be protected too.
- Timing: one month to respond, extendable by up to two more months for complex cases, as long as the user is told why.
BytePreview's explainer goes through scope, formats and limits in more detail:
https://www.bytepreview.com/en/articulos/data-portability-under-gdpr-scope-formats-and-limits?utm_source=dev&utm_medium=social&utm_campaign=bytepreview
Top comments (0)