Data portability rights between service providers

Introduction

Data portability refers to the ability of individuals or organisations to obtain their data from one service provider and transfer it to another service provider in a structured, commonly used and machine-readable format. It enables users to change digital platforms without unnecessarily losing their personal information, transaction history, research records or other valuable data.

Data portability is particularly important in sectors such as healthcare, biotechnology, banking, telecommunications, cloud computing and digital commerce. For example, a patient may wish to transfer medical records from one healthcare provider to another, while a biotechnology research institution may need to move scientific datasets between cloud service providers.

The primary objectives of data portability are to strengthen user control, encourage competition, reduce dependence on individual platforms and improve interoperability between digital services. However, portability must operate alongside privacy, cybersecurity, intellectual-property and confidentiality requirements.

Legal framework governing data portability

1. Indian legal framework

India does not currently provide a universal data portability right covering every category of personal and non-personal data.

The Digital Personal Data Protection Act, 2023 establishes rights for Data Principals, including rights concerning access to information about personal data processing, correction, completion, updating and erasure, subject to applicable provisions. However, it does not expressly establish a general right equivalent to the GDPR's Article 20 data portability right.

Consequently, individuals cannot assume that every service provider is legally required under the DPDP Act to transfer all personal data directly to another provider in a machine-readable format.

The Information Technology Act, 2000, and applicable rules provide additional protections concerning electronic records, confidentiality and security. Contractual arrangements may also establish data-export and transfer rights between customers and service providers.

In the financial sector, the Reserve Bank of India's Account Aggregator framework facilitates consent-based financial information sharing between regulated financial information providers and financial information users. It is an important example of structured data sharing, although it is not a universal portability right.

2. European Union: General Data Protection Regulation

The European Union provides one of the clearest statutory data portability frameworks through Article 20 of the General Data Protection Regulation (GDPR).

Under Article 20, an individual has the right to receive personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format where the statutory conditions are satisfied.

The right also allows individuals to transmit such data to another controller without hindrance from the original controller.

Direct controller-to-controller transmission must be provided where technically feasible.

However, this right has limitations:

It applies to personal data provided by the individual, subject to the interpretation of that expression.

Processing must be based on consent or contract.

Processing must be carried out by automated means.

It must not adversely affect the rights and freedoms of others.

Article 20 does not generally cover every piece of information generated or inferred by a service provider.

3. European Union Data Act, 2023

The EU Data Act establishes additional rights concerning access to and use of data generated by connected products and related services. It also contains provisions facilitating switching between data-processing services, including cloud services.

Its provisions are relevant to organisations seeking to move datasets, applications and digital workloads between cloud providers. The Act has applied since 12 September 2025, subject to the specific commencement dates and transitional provisions applicable to individual requirements.

4. International approaches

Different jurisdictions address data portability through different legal mechanisms.

United Kingdom: UK GDPR Article 20 provides a data portability right substantially similar to the EU framework.

United States: The California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides consumers with rights to obtain certain personal information in a portable and readily usable format.

Australia: The Consumer Data Right framework establishes sector-specific data-sharing rights, particularly in banking and energy.

These approaches demonstrate that portability can be established through general privacy legislation or specialised sectoral frameworks.

Major legal issues concerning data portability

1. User control and consent

Data portability strengthens an individual's ability to control personal information and move between service providers. It reduces unnecessary dependence on a particular digital platform.

For example, a patient changing hospitals may need access to medical records, diagnostic reports and treatment histories. A secure transfer can improve continuity of healthcare and reduce repeated medical investigations.

However, service providers must verify the identity and authority of the requesting individual before transferring sensitive information.

2. Technical interoperability

Data portability requires information to be provided in formats that another service provider can understand and use.

If one platform exports information in an incompatible or proprietary format, the practical value of portability may be limited.

Organisations should therefore develop standardised formats, documented APIs and secure transfer procedures.

Examples include:

CSV and JSON for structured information.

XML for certain data-exchange applications.

FHIR-based formats for healthcare information.

Standardised export mechanisms for cloud services.

The appropriate format depends on the nature of the information and the receiving system.

3. Privacy and third-party information

A portability request may involve information concerning several individuals. For example, a social-network account may contain messages, photographs and contact information relating to other users.

A service provider must balance the requesting individual's portability rights against the privacy and legal rights of third parties.

In biotechnology, genetic information may also reveal information about biological relatives. Consequently, transferring genetic datasets requires careful consideration of consent, confidentiality and applicable privacy laws.

4. Intellectual property and trade secrets

Data portability does not automatically transfer ownership of a service provider's software, algorithms, analytical models or proprietary technology.

For example, a biotechnology company may export its laboratory results from a cloud platform without acquiring ownership of the cloud provider's software or analytical algorithms.

Service providers must distinguish between customer data, personal information, proprietary databases, software and trade secrets.

5. Competition and market dominance

Restrictions on data portability may create barriers to switching service providers. A dominant platform could make it difficult for users to transfer information or impose unreasonable technical obstacles.

Competition authorities may examine such conduct where it restricts competition, creates market-entry barriers or constitutes abuse of dominant position.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21 of the Constitution. The judgment established the importance of informational privacy and individual control over personal information. Although it did not directly recognise a statutory data portability right, its principles provide a constitutional foundation for policies that strengthen individuals' control over their personal data.

2. Schrems II (Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems, 2020)

The Court of Justice of the European Union examined international transfers of personal data from the European Union to the United States. It invalidated the EU-US Privacy Shield and considered safeguards required for international data transfers. Although the case did not directly concern portability, it is relevant because transferring data between service providers must also comply with applicable international data-transfer protections.

3. Google Spain SL v. Agencia Española de Protección de Datos (2014)

The Court of Justice of the European Union examined the processing of personal information by a search engine and recognised the right to seek removal of certain search results in appropriate circumstances. The decision is relevant to the broader development of individual control over personal information. However, the right to delisting is legally distinct from the right to data portability.

4. Competition Commission of India v. Google LLC (2023)

The Supreme Court of India declined to interfere with the National Company Law Appellate Tribunal's decision concerning Google's Android-related competition practices. The underlying proceedings examined restrictions imposed within Google's digital ecosystem and their competitive effects. The case is relevant by analogy because control over digital platforms and barriers to switching may raise competition concerns, although the dispute did not directly determine data portability rights.

5. Orange România SA v. Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (2020)

The Court of Justice of the European Union examined the validity of consent obtained by a telecommunications provider for processing personal data. It emphasised that consent must be freely given, specific, informed and unambiguous. The judgment is relevant to data portability because service providers must ensure that consent-based data processing and related transfers satisfy applicable legal requirements.

Responsibilities of service providers

Service providers should establish transparent procedures for handling portability requests and transferring information securely.

Important compliance measures include:

Providing clear procedures for submitting portability requests.

Verifying the identity of the requesting individual.

Offering data in structured and commonly used formats where legally required.

Supporting direct transfers where technically feasible and legally applicable.

Protecting information relating to third parties.

Maintaining secure APIs and encryption mechanisms.

Avoiding unreasonable technical barriers to switching.

Establishing clear retention and deletion procedures after lawful transfers.

Informing users about limitations arising from intellectual-property and confidentiality rights.

Organisations should also maintain records of portability requests, verification procedures, transfer dates and any reasons for refusing or limiting a request.

Conclusion

Data portability rights between service providers are an important part of modern digital governance. They enable individuals and organisations to move information between platforms, improve competition and reduce dependence on individual service providers. The GDPR provides an express statutory portability right, while India's DPDP Act, 2023, does not establish an equivalent general right. Sector-specific mechanisms, such as India's Account Aggregator framework, nevertheless facilitate structured information sharing. Judicial decisions concerning privacy, consent, international data transfers and digital competition provide supporting legal principles. Effective data portability requires clear legal rights, standardised technical formats, secure transfer systems and safeguards for third-party privacy and intellectual property.