Definition
Data portability under GDPR Article 20 gives individuals the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. For email marketing, this means subscribers can request a copy of all personal data an organisation holds about them for email purposes, including their email address, name, preferences, engagement history, and segmentation data, in a format that can be easily imported into another email system.
The right to data portability applies only to data processed based on consent or contract, and only to data that was provided by the individual or generated through their activity. For email marketers, this typically covers: subscriber profile data (name, email address, preferences), behavioural data (opens, clicks, conversions, browse history), and communication history (emails sent and received). It does not cover data processed for legal obligation purposes or data that is anonymised or aggregated. The interaction between portability and deletion is important: a subscriber can request both portability (to get their data) and erasure (to delete it from your systems) in the same request.
Implementation of data portability requires both technical and procedural infrastructure. The export must be produced within one month of the request, must be in a machine-readable format, and must not include data of other individuals. CSV exports are the most common format for email data portability because virtually every ESP supports CSV import. JSON is increasingly preferred for complex data structures. The export should include metadata about the data structure to enable smooth import into the receiving system. Some organisations provide self-service download portals rather than manual export processing for frequently requested data types.
Best Practices
Design a standardised export template that includes all subscriber data categories. Your template should include fields for: email address, subscription date, consent type, consent timestamp, opt-in IP address, preference centre selections, custom field values, segment membership, campaign engagement history (open/click/conversion timestamps), and communication preferences. Document the field definitions so the receiving organisation can understand the data.
Offer a self-service data download portal to reduce manual processing burden. Many subscribers will request their data simply to see what you hold, not because they intend to switch providers. A self-service download option in your preference centre handles these requests instantly without staff intervention. The download should be available immediately and expire after a set period (typically 7-14 days) for security.
Test your export process with multiple target ESPs to ensure compatibility. An export that cannot be imported into a common ESP is not truly portable. Test your CSV or JSON export against major ESP import functions (Mailchimp, Klaviyo, HubSpot, Salesforce Marketing Cloud) to identify and fix compatibility issues. Document any known limitations for the subscriber.
Do not include suppression list data or data of other individuals in the export. The right to portability applies only to the individual's own data. Suppression records (unsubscribe or erasure events) are typically not portable because they relate to your legal obligations rather than consent or contract processing. Take care to exclude data that identifies other people, such as referral program data or shared purchase history.
Integrate portability with your erasure workflow. Subscribers who request data portability often also intend to close their account or erase their data. After providing the portable data, ask whether they also want erasure. Processing these requests together saves time and provides better customer experience. Ensure your systems support this combined workflow.
Related Glossary Terms
Australia Spam Act
Australia's Spam Act 2003 regulates commercial electronic messages including email. It requires consent, functional unsubscribe mechanisms within 5 working days, and sender identification. Penalties reach AUD $2.22 million per day.
Email CASL
Canada's Anti-Spam Legislation requirements for commercial electronic messages, including consent types, record-keeping, and penalties up to $10 million per violation.
Email CCPA
California Consumer Privacy Act requirements for email marketing, including consumer rights to access, delete, and opt out of data collection and sale.
Email Consent Record
Email consent record-keeping captures proof of opt-in including timestamp, IP address, method, and exact wording shown. GDPR requires controllers to demonstrate consent upon request.
Email Data Retention
Email data retention policies govern how long subscriber data, activity logs, consent records, and campaign data are kept. GDPR requires data not be kept longer than necessary for the processing purpose.
Email Encryption
Email encryption uses TLS for transit security and end-to-end methods like PGP, with compliance requirements for HIPAA, GDPR, and impacts on marketing email tracking.
Frequently Asked Questions
Include all personal data the subscriber provided (name, email, preferences) and data generated through their activity (open/click history, conversion events, segment assignments). Exclude data processed for legal obligation purposes, anonymised aggregate data, and data of other individuals. The scope is data processed based on consent or contract performance.
A subject access request (SAR) allows an individual to see their data for informational purposes. Data portability additionally requires the data to be provided in a machine-readable format for transfer to another provider. Portability also has a narrower scope (only consent or contract-based processing) than SARs (which cover all processing).
Yes. The subscriber can specify the target ESP or ask for a standard format. You are not required to deliver the data directly to the target ESP; you must provide it to the subscriber in a machine-readable format. The subscriber then handles the import into their chosen system. You must not charge a fee for providing the data.
There is no legal limit on the frequency of portability requests. However, if requests are manifestly unfounded or excessive (particularly if repetitive), you can charge a reasonable administrative fee or refuse to act. Document the circumstances of any refusal and inform the subscriber of their right to complain to a regulator.
CSV is the most widely supported format for portability because virtually all email marketing platforms support CSV import. JSON is appropriate for more complex data structures with nested relationships. XML or TSV are also acceptable but less commonly supported. The format must be machine-readable, commonly used, and well-documented to satisfy the GDPR requirement.