Skip to main content

Q2 - Can a person request all their data be “ported” (moved) to another company like GDPR allows?

Answer

No — the Digital Personal Data Protection Act, 2023 (DPDPA) does not include a right to data portability, unlike the European Union’s General Data Protection Regulation (GDPR).

The DPDPA provides rights such as:

  • Right to access one’s data (Section 11);
  • Right to correction and erasure (Section 12);
  • Right to grievance redressal (Section 13);
  • Right to nominate another person in case of death or incapacity (Section 14)

However, it does not include any provision allowing a Data Principal to request their data be transferred or “ported” from one company to another.

1. Scope of the Access Right​

Under Section 11, a Data Principal can request:

  • A summary of their personal data being processed;
  • Details of processing activities and entities with whom data is shared; and
  • Other related information as prescribed by the Government.

This right is limited to information disclosure — it does not allow individuals to download, transfer, or reuse their data elsewhere.

2. Comparison with GDPR​

AspectGDPR (Article 20)DPDPA (2023)
Right to data portabilityYes — individuals can request a copy of their data in a machine-readable format and transfer it to another controller.No such right; only access, correction, and erasure are allowed.
PurposeTo empower individuals and foster competition and interoperability between services.Focused mainly on lawful processing, consent, and accountability.
TransferabilityExplicitly allowed between service providers.Not mentioned; sharing occurs only under lawful processing or consent.

3. Practical Effect​

This means:

  • Individuals in India cannot request their personal data to be directly moved from one company (like a bank or social media platform) to another.
  • Organizations are not required to create machine-readable data export tools or APIs for portability.
  • Any data transfer must still follow lawful processing and consent mechanisms under Sections 6–8.
Example

A user under GDPR can ask a streaming service to transfer their listening history directly to another platform.
Under DPDPA, the same user in India can request access to their data summary, but cannot demand the data be ported or transferred to another service.

4. Possible Future Inclusion​

While the DPDPA omits this right for now, the Central Government may introduce data portability in future rules or amendments — especially if interoperability between services becomes a policy priority under India’s digital economy framework.

Referenced Provisions:

  • Section 11 – Right to access information about personal data.
  • Section 12 – Right to correction and erasure.
  • Section 13 – Grievance redressal mechanism.
  • Section 14 – Right to nominate another person.
  • No clause exists providing a right to data portability under the DPDPA 2023.