Journal · 5 Jul 2026 · 6 min read
GDPR Data Portability, Explained: How to Actually Move Your Data
A plain-English guide to your GDPR Article 20 data portability right — what it covers, how to request your data, and what personal AI can do with it.
Article 20 of the GDPR gives every person in the EU the right to receive their personal data in a "structured, commonly used and machine-readable format" — and to move it to another service. In practice, most people never use it. The interfaces are hidden, the exports are messy, and there is nowhere useful to send the file when it finally arrives.
What data portability actually covers
It covers the data you provided to a service and any data generated by your activity on it — search history, listening history, messages, health metrics, purchase records. It does not automatically cover derived analytics or third-party inferences, though many providers include those anyway.
How to request your data
- Open the account settings of the service and look for "Download your data", "Export", or "Privacy".
- Choose JSON or CSV where offered. Avoid PDF — it is not machine-readable in any useful sense.
- Note the delivery time. Providers have 30 days to respond, extendable by 60 days for complex requests.
Why exports rarely help on their own
A ZIP file of JSON exports from ten different services is not portable in any practical sense. The schemas do not match, timestamps use different timezones, and the identifiers do not resolve across providers. This is where a personal data layer changes the equation: instead of ten dead archives, your data lives in one place you control, structured for you and any AI you allow to read it.
What comes next
The EU Data Act extends portability into IoT devices and cloud services from September 2025. The European Health Data Space (EHDS) does the same for health records. Together they build the legal foundation for what My Data Agent runs on: your data, in your custody, portable by default.