Data Portability: The Data Subject’s Right and How to Implement It

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Data portability is one of the most strategic rights under the LGPD (Brazil’s General Personal Data Protection Law). It lets data subjects transfer their information between service providers and strengthens their control over their own informational assets.

The Right to Portability Under the General Personal Data Protection Law

When you examine the regulatory framework of Law 13.709/2018 (the LGPD), you find that the right to data portability is set out in Article 18, item V, as one of the data subject’s fundamental prerogatives. This provision ensures that any individual may request that his or her personal data be transferred to another service or product provider, subject to the trade and industrial secrets of the original controller. It is a mechanism that expands informational self-determination and encourages healthy competition among processing agents.

In practice, portability works as a bridge between the individual right of the data subject and market dynamics. Organizations that process personal data must be prepared to receive and handle portability requests in a structured way, with defined deadlines and interoperable formats. The ANPD (Brazil’s National Data Protection Authority) has the authority to regulate the applicable technical standards, as provided in Article 40 of the LGPD, although detailed regulation is still being developed.

It is important to stress that the right to portability is not the same as the right of access to data (Article 18, item II), nor the right to deletion (Article 18, item VI). Access allows data subjects to find out what information is being processed. Portability goes further: it requires that the data be transferred in a format that another controller can use. This distinction has significant practical implications for how organizations build their internal processes.

Scope and Limits of Portability

When we conduct data protection due diligence, one of the most sensitive points we find is defining the scope of portability. Not all personal data processed by an organization is portable. The LGPD itself provides that portability must respect trade and industrial secrets. This means that data derived from proprietary analytical processes, such as credit scores or behavioral profiles generated by algorithms, may not be subject to transfer.

The data that can be ported is, as a rule, data provided directly by the data subject (declared data) and data observed during the consumer relationship or the provision of services (observed data), such as transaction history and usage records. Inferred or derived data, which results from processing and analysis carried out by the controller, tends to fall outside the scope of portability because it involves intellectual property and business secrets.

Another point that deserves attention is third-party data. If a record contains information about other individuals (such as dependents on a health plan or contacts in an address book), porting that data calls for extra caution. Transferring third-party information without an adequate legal basis can amount to unlawful processing and give rise to liability. For that reason, organizations should establish clear criteria for separating the requester’s data from data belonging to third parties.

Time limits must also be considered. The LGPD does not specify how far back a data subject may request portability, but best practices indicate that the period should match the time the organization may legitimately retain the data. If the data has already been deleted in accordance with the retention policy, there is no obligation to port it.

Technical and Operational Implementation

From an operational standpoint, implementing data portability requires planning on multiple levels. We start with governance, by defining internal policies that set out responsibilities, approval workflows, and response deadlines. Data protection law requires that data subjects’ requests be handled in a simplified manner and within the legal deadlines. If that is impossible, the controller must provide a clear and complete statement indicating the factual or legal reasons.

On the technical side, interoperability is the biggest challenge. For portability to be effective, data must be exported in open, structured formats that other systems can interpret. Formats such as JSON, XML, and CSV are widely used, but industry-specific standardization is still at an early stage in Brazil. Until the ANPD establishes mandatory standards, organizations should adopt widely recognized formats and document the structure of the exported data through data dictionaries or descriptive schemas.

Transfer security is another critical aspect. When data is ported, it moves between different technological environments, which increases exposure to risks such as interception, leakage, or data corruption. Measures such as end-to-end encryption, strong authentication of the requester, and secure transmission channels (such as APIs protected by TLS certificates) are essential. Organizations with mature data protection programs often implement dedicated portability APIs, with OAuth 2.0 authentication controls and detailed audit logs.

Data portability is not just a right of the data subject. It is also an indicator of an organization’s maturity in data protection and digital governance.

Verifying the requester’s identity deserves special mention. Before carrying out any portability request, the controller must confirm that the requester is in fact the data subject or the data subject’s duly appointed legal representative. Failures in this verification can lead to personal data being improperly shared with unauthorized third parties, resulting in security incidents and liability under Articles 42 to 45 of the LGPD.

Portability in the Context of Due Diligence

In data protection due diligence, an organization’s ability to handle portability requests says a great deal about its level of LGPD compliance. In these reviews, we assess whether the organization has a structured channel for receiving requests from data subjects, whether legal deadlines are met, whether the procedures it follows are documented, and whether its technical controls are adequate.

When a company goes through a merger, an acquisition, or a corporate restructuring, data portability becomes even more important. In these transactions, it is essential to map the data assets that will be transferred between the entities involved and to verify whether the legal bases for processing remain valid after the transaction. Article 9 of the LGPD requires transparency about the purpose of processing, and any substantial change in how the data is used may require new consent or another adequate legal basis.

Another relevant aspect of due diligence is the review of contracts with processors. The review checks whether the contracts include clauses requiring the processor to cooperate with portability by providing the data in an adequate format and within the established deadlines. The absence of such clauses can create operational bottlenecks when the controller must respond to a data subject’s request but depends on a third party to extract and format the data.

In the financial sector, data portability has taken on specific contours with Open Finance, which is regulated by the Central Bank. In this ecosystem, the portability of registration and transaction data between financial institutions already operates with defined technical standards, standardized APIs, and centralized governance. This model serves as a reference for other sectors seeking to implement portability efficiently and securely. In health care, telecommunications, and education, similar initiatives are at different stages of development.

Best Practices and Compliance Recommendations

Based on our experience with LGPD compliance projects, we have put together a set of practical recommendations for organizations that want to implement data portability robustly. The first step is to take a complete inventory of the personal data being processed, classifying it by origin (declared, observed, or inferred) and identifying which data is portable.

Next, we recommend creating a standard operating procedure (SOP) specific to portability. It should cover receiving the request, verifying identity, extracting the data, formatting, validation, secure transmission, and recording the operation. Each step should have designated owners and internal deadlines that ensure compliance with the 15-day legal deadline.

Training the teams involved is equally important. Staff who handle data subject requests, work in information technology, or serve in the legal department need to understand the portability workflow and its implications. Periodic simulations (portability drills) help identify bottlenecks and improve the process before a real request exposes weaknesses.

On the documentation side, we continue to recommend that all portability requests be logged in a record of processing operations, including the date of the request, the identification of the data subject, the data ported, the recipient of the transfer, the format used, and confirmation of completion. This record serves both as evidence of compliance before the ANPD and as input for continuous improvement of the process.

Finally, it is worth emphasizing the importance of monitoring regulatory developments. The ANPD has a regulatory agenda that includes standardizing technical requirements for portability, and any specific regulations may require adjustments to processes already in place. Staying current on the Authority’s publications and taking part in public consultations are ways to anticipate changes and keep the organization in compliance.

This topic is directly related to the right to be forgotten online, which we cover in a dedicated article.

This topic is directly related to the right to object to data processing, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.