Question

When handling a Data Subject Access Request (DSAR), what is the specific technical requirement for an organization to comply with the right to data portability?

Accepted Answer

The specific technical requirement for data portability under regulations like the GDPR is that the personal data provided to the data subject must be delivered in a structured, commonly used, and machine-readable format. Structured means the data is organized in a way that allows a computer system to easily identify and process the information, such as a database table or a CSV file. Commonly used means the format is widely supported by standard software, ensuring the data is not locked into a proprietary or obscure file type that only one specific application can open. Machine-readable means the data is encoded in a format that software can automatically parse, extract, and reuse without human intervention, such as XML, JSON, or CSV files. An example of a compliant delivery would be providing a user&#x27;s transaction history in a CSV file rather than as a password-protected PDF image, because the CSV allows the user to import that data directly into another financial application or spreadsheet software for immediate analysis. Furthermore, if technically feasible, the organization must transmit this data directly from their own system to another controller if the data subject requests it and the transfer is secure.

Home → All Courses → Engineering and Technology Courses → Data Governance and Privacy Engineering → Flashcard

When handling a Data Subject Access Request (DSAR), what is the specific technical requirement for an organization to comply with the right to data portability?