Definition
The right to data portability, established under Article 20 of the GDPR, gives individuals the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller without hindrance.
For email marketing, data portability means subscribers can request their data from your ESP and potentially move it to another platform. This right specifically applies to data processed by automated means based on consent or contract.
What Data Is Portable in Email Marketing
| Data Type | Portable? | Notes |
|---|---|---|
| Account/profile data | Yes | Name, email, preferences, custom fields |
| Consent records | Yes | Timestamp, source, consent wording |
| Engagement history | Yes | Open rates, click data, send history |
| Purchase history | Yes | If linked to subscriber profile |
| Segmentation data | Usually not | Algorithmic segment membership |
| Inferred preferences | Usually not | Scoring, predictive models |
| Analytics aggregations | No | Aggregated data, not personal |
Portable Data Format
Data must be provided in a structured, commonly used, machine-readable format:
| Format | Best For | Supported By |
|---|---|---|
| CSV | Simple data, contacts | Most ESPs |
| JSON | Complex data, nested relationships | API-focused platforms |
| XML | Enterprise data exchange | Enterprise ESPs |
How Data Portability Affects Email Marketing
- ESP switching: Subscribers who request data export can move their profile data to a competitor ESP more easily.
- Data ownership: Portability reinforces that subscriber data belongs to the subscriber, not the organisation.
- Platform dependency: Reduced switching costs may influence ESP contract negotiations and retention.
- System design: Email platforms must support data export in portable formats to comply with GDPR.
Best Practices for Data Portability Compliance
- Ensure your ESP supports data export: Most ESPs provide subscriber data export functionality. Verify yours includes all portable data fields.
- Respond within one month: Same timeline as DSARs — one month for data portability requests.
- Transmit directly when requested: If the subscriber requests direct transmission to another platform, facilitate this where technically feasible.
- Document portable data mapping: Maintain records of what data is stored where and which systems can export it.
Was this useful?
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
AI Email Summary
An AI email summary is a short, machine-generated overview of an email's key points, shown by Gmail, Outlook and Apple Mail before a recipient opens the message. It is reshaping how email marketers think about subject lines, preview text and open rates.
AI Inbox Summary
An AI inbox summary is an AI-generated digest that condenses unread email — often highlighting news, actions and senders — changing how clearly your marketing email reaches and engages subscribers.
AI Inbox
An AI inbox is an email client that uses artificial intelligence to summarise, sort, prioritise and sometimes answer emails before the human recipient reads them. It is transforming email marketing metrics and copywriting.
Frequently Asked Questions
A DSAR gives the right to access and review personal data. Data portability gives the right to export and reuse that data in another service. Data portability is a subset of the broader right of access, focused on transferability.
Data portability applies only to data provided by the subscriber (name, email, preferences) and data generated by their activity (engagement history). It does not apply to data inferred or derived by the controller (segmentation scores, predictive models).
Yes. If the request is technically feasible, you must facilitate transmission to another platform. This does not require you to build custom integrations, but you should provide the data in a format the receiving platform can import.
Within one month of receiving the request, with a possible two-month extension for complex requests. The same timeline applies to DSARs and data portability requests.
Data portability is limited to data processed by automated means based on consent or contract. Data processed for other lawful bases (legitimate interest, legal obligation) is not portable. Explain which data cannot be exported and why.