Data portability is narrower than a database export
The right to portability covers personal data the individual provided, held under consent or contract, and processed automatically.
It does not cover everything about them in your systems: inferences you derived, records created by others, or data held under a different lawful basis. Organisations tend to interpret it either as a full export or as nothing, and both are wrong in ways that matter.
More on UK GDPR
- Lawful basis is the reason processing is permittedIt will not turn without the reason
- Consent is one lawful basis, not the default answerOne setting out of six
- Access rights concern personal data, not every documentThe lines about you, not the page
- Erasure is not an absolute delete buttonIt will not travel the whole way
- Rectification requires organisations to be able to correct inaccurate personal data wherever it is maintainedCorrect it once, then chase every copy
- Restriction can pause use without erasing dataStopped, not shredded