Requirement
Where processing is by automated means and based on consent or contract, the data subject may receive their personal data in a structured, commonly used and machine-readable format.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
portabilityexportmachine-readablemachine readablestructured format
Supporting terms — specificity signals
section 38jsoncsvdownloadapiself-service
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.15 | Right of access | data-subject-rights |
| GDPR | Art.18 | Right to restriction of processing | data-subject-rights |
| GDPR | Art.20 | Right to data portability | data-subject-rights |
| GDPR | Art.22 | Automated decision-making and profiling | data-subject-rights |
| CCPA/CPRA | 1798.110 & 1798.115 | Right to know and access | data-subject-rights |
| CCPA/CPRA | 1798.125 | Non-discrimination and financial incentives | data-subject-rights |
| CCPA/CPRA | 1798.130(a)(1)-(2) | Methods for requests and 45-day response | data-subject-rights |
| CCPA/CPRA | Regs (ADMT) | Automated decision-making technology for significant decisions | data-subject-rights |