When does the right to data portability apply?

Article 20(1) GDPR applies only where both conditions are met: the processing is based on consent (Article 6(1)(a) or 9(2)(a)) or on a contract (Article 6(1)(b)), and it is carried out by automated means. Recital 68 says it should not apply where processing is based on another legal ground, such as a legal obligation or legitimate interests. If it does not apply, the person may still have a right of access under Article 15.

Do we have to export AI scores, summaries and profiles?

Article 20 covers personal data the person has provided to you. The guidelines on data portability (WP242 rev.01, endorsed by the EDPB on 25 May 2018) read this as data actively provided (forms, uploads, messages typed into a chatbot) and data observed from their use of the service (activity and usage logs), but not inferred or derived data that you create, such as a lead score, risk score or an AI-written profile. Those usually remain covered by the right of access instead.

How fast, in what format, and can we charge?

Article 12(3) says you reply without undue delay and within one month of receipt, extendable by two further months for complex or numerous requests if you tell the person within the first month. Article 20(1) requires a structured, commonly used and machine-readable format (for example CSV or JSON). Article 12(5) says it is free of charge, unless requests are manifestly unfounded or excessive. Article 20(2) adds direct transmission to another controller where technically feasible, and Article 20(4) says the export must not adversely affect the rights and freedoms of others.

A customer wants their data exported from your AI tools? A GDPR Article 20 data portability request sheet for small businesses

Updated 25 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished portability request sheet: one row per request, a formula that tells you whether Article 20 applies (consent or contract, and automated means), a column for the data to include from each AI tool, a column for what to leave out and why (AI scores and other inferred data, other people's data), the export format and route, a reply-date formula, a status formula and two made-up example rows.

Short answer: if a customer or user asks for "all my data" to take to another provider, and you hold it on the basis of their consent or a contract in software, you must give them what they provided (including what they typed into your chatbot and their usage history) in a file a machine can read, free of charge and within one month. AI scores and profiles you created are generally not part of the export, but the person can still see them through an access request.

Step 1: check whether Article 20 applies

Two tests, both needed: the lawful basis is consent or contract, and the processing is automated (Art. 20(1)). Look the basis up in your records; do not decide it per request.
Typical yes: a SaaS or app customer leaving for a competitor, an online shop customer wanting their order history, a client of a coaching or booking service wanting their chatbot conversations and uploaded files.
Typical no: data you keep because the law requires it (invoices for tax), data held on legitimate interests (for example a cold-prospect list), paper files. Handle those as access requests.

Step 2: the portability request sheet (one row per request)

Column	What to write	Source
A. Received	Date the request arrived and how (email, form, chat). The person does not have to say "portability" or "Article 20"; "send me all my data so I can move to another provider" counts	Art. 12(2), 12(3)
B. Reply due	`=EDATE(A2,1)`. If you extend for a complex request, use `=EDATE(A2,3)` and tell the person, with reasons, before B2	Art. 12(3)
C. Person and identity check	Who asked and how you confirmed it is them (logged-in account, order number). Only ask for extra identity information if you have reasonable doubts	Art. 12(6)
D. Lawful basis	From your Article 30 records: consent, contract, or other (legal obligation, legitimate interests, public task)	Art. 20(1)(a); Recital 68
E. Automated?	Yes if the data sits in software (AI tool, CRM, shop, app); No for paper files only	Art. 20(1)(b)
F. Article 20 applies?	`=IF(AND(OR(D2="consent",D2="contract"),E2="Yes"),"Portability","Access only (Art. 15)")`. If it says access only, handle it with the access request sheet and tell the person why	Art. 20(1)
G. Data to include	Provided and generated by use: account and profile fields, files uploaded, prompts and messages they typed into your chatbot, chat transcripts, order history, usage or activity logs. List each AI tool and system it comes from	Art. 20(1); WP242 rev.01
H. Data to leave out (and why)	Inferred or derived data you created: AI lead or risk scores, AI-written summaries and profiles, segments (these stay under Art. 15 access). Other people's data inside the set (a colleague's messages in a shared thread): remove or check before sending	Art. 20(4); WP242 rev.01
I. Format and route	CSV or JSON with a short field list, sent to the person by a secure link, or sent directly to the new provider if they asked and it is technically feasible	Art. 20(1), 20(2)
J. Status	`=IF(K2<>"","Sent",IF(TODAY()>B2-7,"Reply due within 7 days","Open"))`. The 7-day warning is our own working rule, not a legal one	Art. 12(3)
K. Sent	Date sent, file names, who checked column H, and the reply you sent if Article 20 did not apply	Art. 5(2)
L. Erasure asked too?	Portability does not delete anything. If the person also wants the data deleted, open a separate row in your erasure sheet	Art. 20(3); Art. 17

Put the column letters A to L in row 1 and the first request in row 2; the formulas above assume that layout and the exact words consent, contract and Yes in D and E (a drop-down list avoids typing errors). Sort by column J so "Reply due within 7 days" comes first.

Step 3: getting the export out of AI tools

Check each tool's own export: many chatbot, CRM and helpdesk tools have a per-contact export to CSV or JSON. Write down in your records which button or menu does it, so the next request takes minutes.
Where a supplier holds the data for you as processor, your processor agreement should oblige them to help you answer data subject requests (Art. 28(3)(e)). Ask early; the one-month clock is yours.
Add a one-page field list (column name, meaning) so the file is usable. Recital 68 encourages interoperable formats but says you are not obliged to adopt technically compatible systems.
Remove other people's personal data that would adversely affect them before sending (Art. 20(4)), and send by a secure link rather than as a plain email attachment.

Two example rows (made-up businesses, for illustration only)

Example 1, a small online coaching service, "Example AI chat assistant": A. 02/11/2026 by email · B. 02/12/2026 · C. client, logged-in account · D. contract · E. Yes · F. Portability · G. profile fields, uploaded worksheets, all chat messages typed by the client, session booking history · H. left out: AI-written progress summary and "engagement score" (offered under Art. 15 instead) · I. JSON + CSV with field list, secure link · J. Sent · K. 09/11/2026, owner checked H · L. no.

Example 2, a small design agency, "Example AI lead-scoring CRM": A. 04/11/2026 via contact form · B. 04/12/2026 · C. former prospect, email matched · D. other (legitimate interests) · E. Yes · F. Access only (Art. 15) · G. not applicable · H. not applicable · I. access copy sent instead, with a note explaining why Article 20 does not apply · J. Sent · K. 12/11/2026 · L. yes, erasure row opened 12/11/2026.

Do this week

Add a "lawful basis" column to your list of AI tools if it is missing, so column D is a copy-paste
For each AI tool, find and note the per-person export function and the formats it offers
Decide which AI-generated fields count as inferred (scores, summaries, segments) and write the list down once
Check that your processor agreements cover help with data subject requests

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 12, 15, 17, 20 and 28 and Recital 68, as published on gdpr-info.eu) and to the Article 29 Working Party guidelines on the right to data portability (WP242 rev.01), endorsed by the EDPB. The split between provided, observed and inferred data comes from those guidelines; national authorities and courts may take a stricter view, so check your data protection authority's guidance. The status rule and 7-day warning are our own working rules. Example rows are made up for illustration and do not describe any real business or supplier. Checked on 25 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Portability requests often arrive when a client's customer switches provider, at the same time as a final invoice or contract end. Hand clients this sheet with the access request sheet and the client AI inventory, so every request has a dated row. Stay inside your professional rules and refer legal questions on.

Keep requests next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with its lawful basis and export route, and attach each portability row as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Article 20 GDPR, Right to data portability (with Recital 68, Article 12, Transparent information and modalities and Article 6, Lawfulness of processing); official text: Regulation (EU) 2016/679
EDPB: Guidelines on the right to data portability (WP29 guidelines endorsed by the EDPB on 25 May 2018); also on the Article 29 Working Party archive

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.