What it asks for. Where processing is based on consent or a contract and carried out by automated means, individuals can receive the personal data they provided to a controller in a structured, commonly used and machine-readable format, and transmit it to another controller. Where technically feasible, they can have it sent directly from one controller to another.
In practice. Organisations identify which processing activities fall in scope and build an export that includes data actively provided and data observed through use of the service, in formats such as JSON or CSV. Requests are verified, handled within the Article 12 timescale and logged. The export should exclude data that would adversely affect the rights of others, and portability does not remove the right to erasure. Evidence includes a documented procedure, a sample export file and the request log.
Common gaps. Common gaps are exports as PDF or screenshots that are not machine-readable, exports that omit observed data, and no clear mapping of which processing relies on consent or contract.