Definition
Data portability under GDPR Article 20 gives individuals the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. For email marketing, this means subscribers can request a copy of all personal data an organisation holds about them for email purposes, including their email address, name, preferences, engagement history, and segmentation data, in a format that can be easily imported into another email system.
The right to data portability applies only to data processed based on consent or contract, and only to data that was provided by the individual or generated through their activity. For email marketers, this typically covers: subscriber profile data (name, email address, preferences), behavioural data (opens, clicks, conversions, browse history), and communication history (emails sent and received). It does not cover data processed for legal obligation purposes or data that is anonymised or aggregated. The interaction between portability and deletion is important: a subscriber can request both portability (to get their data) and erasure (to delete it from your systems) in the same request.
Implementation of data portability requires both technical and procedural infrastructure. The export must be produced within one month of the request, must be in a machine-readable format, and must not include data of other individuals. CSV exports are the most common format for email data portability because virtually every ESP supports CSV import. JSON is increasingly preferred for complex data structures. The export should include metadata about the data structure to enable smooth import into the receiving system. Some organisations provide self-service download portals rather than manual export processing for frequently requested data types.
Best Practices
Design a standardised export template that includes all subscriber data categories. Your template should include fields for: email address, subscription date, consent type, consent timestamp, opt-in IP address, preference centre selections, custom field values, segment membership, campaign engagement history (open/click/conversion timestamps), and communication preferences. Document the field definitions so the receiving organisation can understand the data.
Offer a self-service data download portal to reduce manual processing burden. Many subscribers will request their data simply to see what you hold, not because they intend to switch providers. A self-service download option in your preference centre handles these requests instantly without staff intervention. The download should be available immediately and expire after a set period (typically 7-14 days) for security.
Test your export process with multiple target ESPs to ensure compatibility. An export that cannot be imported into a common ESP is not truly portable. Test your CSV or JSON export against major ESP import functions (Mailchimp, Klaviyo, HubSpot, Salesforce Marketing Cloud) to identify and fix compatibility issues. Document any known limitations for the subscriber.
Do not include suppression list data or data of other individuals in the export. The right to portability applies only to the individual's own data. Suppression records (unsubscribe or erasure events) are typically not portable because they relate to your legal obligations rather than consent or contract processing. Take care to exclude data that identifies other people, such as referral program data or shared purchase history.
Integrate portability with your erasure workflow. Subscribers who request data portability often also intend to close their account or erase their data. After providing the portable data, ask whether they also want erasure. Processing these requests together saves time and provides better customer experience. Ensure your systems support this combined workflow.
Related Glossary Terms
Consent Banner
A consent banner is an on-site notice that informs visitors about data collection and allows them to agree to or manage email marketing preferences.
Cookieless Tracking in Email
Cookieless tracking in email is the measurement of email-driven behavior using methods that do not rely on third-party browser cookies.
Email Account Health Score
A composite metric that evaluates the overall health of an email sending programme based on deliverability, engagement, list quality, and compliance factors.
Email Anti-Spam Laws
Overview of global anti-spam regulations including CAN-SPAM, CASL, GDPR, the Australian Spam Act, and POPIA with compliance requirements for each jurisdiction.
Australia Spam Act
Australia's Spam Act 2003 regulates commercial electronic messages including email. It requires consent, functional unsubscribe mechanisms within 5 working days, and sender identification. Penalties reach AUD $2.22 million per day.
Email B2B Consent
The legal requirements for B2B email marketing consent, covering GDPR legitimate interest, CASL implied consent, CAN-SPAM exemptions, and jurisdiction-specific best practices.
Frequently Asked Questions
Include all personal data the subscriber provided (name, email, preferences) and data generated through their activity (open/click history, conversion events, segment assignments). Exclude data processed for legal obligation purposes, anonymised aggregate data, and data of other individuals. The scope is data processed based on consent or contract performance.
A subject access request (SAR) allows an individual to see their data for informational purposes. Data portability additionally requires the data to be provided in a machine-readable format for transfer to another provider. Portability also has a narrower scope (only consent or contract-based processing) than SARs (which cover all processing).
Yes. The subscriber can specify the target ESP or ask for a standard format. You are not required to deliver the data directly to the target ESP; you must provide it to the subscriber in a machine-readable format. The subscriber then handles the import into their chosen system. You must not charge a fee for providing the data.
There is no legal limit on the frequency of portability requests. However, if requests are manifestly unfounded or excessive (particularly if repetitive), you can charge a reasonable administrative fee or refuse to act. Document the circumstances of any refusal and inform the subscriber of their right to complain to a regulator.
CSV is the most widely supported format for portability because virtually all email marketing platforms support CSV import. JSON is appropriate for more complex data structures with nested relationships. XML or TSV are also acceptable but less commonly supported. The format must be machine-readable, commonly used, and well-documented to satisfy the GDPR requirement.