Data portability clause

Definition

A data portability clause obliges a supplier to make a customer's data available in a structured, commonly used and machine-readable format so it can be migrated to another system or provider. It gives contractual effect to the GDPR right to data portability and is closely linked to exit and lock-in concerns. The clause should specify formats, timing, completeness, and any assistance with migration.

Example

On termination the SaaS provider must, under the data portability clause, export all customer records as CSV within ten business days.

Why this is a business risk

Without a data portability clause, a supplier controls the terms on which data is released, which creates a significant lock-in and a costly negotiation at precisely the moment the relationship is ending. Where personal data is involved, the absence of clear portability obligations can also create GDPR compliance exposure for the data controller. Businesses that store large volumes of operational data in third-party systems are especially vulnerable if this is not addressed at contracting time.

How to manage it

• Include a data portability clause in every SaaS or platform contract at signing, not as an afterthought.
• Specify the exact formats (CSV, JSON, SQL dump, etc.), completeness requirements, and the timeline for delivery.
• Clarify whether migration assistance is included or at extra cost, and cap any additional fees.
• Periodically test the export process to confirm data can actually be extracted in the agreed format before you need it.

Legal references

• GDPR Art. 20 GDPR: right to data portability EU law

Unless marked otherwise, references are to Dutch law (Burgerlijk Wetboek, the Dutch Civil Code); EU instruments such as the GDPR apply across the EU. This is general information, not legal advice. Other jurisdictions treat these concepts differently. Verify the current text and your situation with a qualified lawyer.