DPDP does not create a general right to data portability

Imagine a customer asking an app to send every item in their account directly to a competing service. The support team finds an international privacy template and replies that DPDP guarantees data portability. That statement goes further than the Indian Act.

DPDP does not create a general right to receive all personal data in a reusable format and transmit it to another provider. Its rights provisions in sections 11 to 14 cover access information, correction and erasure, grievance redressal and nomination within their specified conditions. Describing those accurately helps the team answer the actual request without promising a different legal entitlement.

As at 22 October 2026, these substantive rights are scheduled to commence on 13 May 2027. The Consent Manager registration provisions have a separate scheduled phase on 13 November 2026 under the Act commencement notification and rule 1(3) and 1(4). Do not treat every rule mentioning data access as already operational across all businesses.

Access information has a defined scope

Section 11 provides for specified information from a Data Fiduciary to whom the person previously gave consent, including the situation referred to in section 7(a). It includes a summary of personal data being processed and processing activities, plus identities of other Data Fiduciaries and Data Processors with whom data has been shared and a description of that data. The specified law-enforcement sharing exception in section 11(2) concerns clauses 11(1)(b) and (c); it is not a general exception to the summary in clause (a).

This is not an unqualified promise to supply every underlying document, every internal analysis or every record about other people. A request-handling procedure should identify the information the provision covers and review the actual context.

Suppose a hypothetical fitness-booking service receives a request for “all my data.” The first useful step is to clarify whether the person wants to understand processing, correct an entry, close the account, obtain a personal copy of bookings or move information elsewhere. Clarification should help provide the right response, not become a device for avoiding it.

Consent Manager records are a separate issue

The First Schedule, Part B of the Rules requires a registered Consent Manager to maintain specified records relating to consents, notices and sharing. It also provides for access to those records and, on request and in accordance with its terms of service, provision of their information in machine-readable form. That requirement belongs to the specific Consent Manager framework.

It does not turn every privacy dashboard into a registered Consent Manager. It also does not establish a general obligation for every shop, school or app to export its entire customer database in a competitor’s preferred schema. The role, the records and the applicable commencement provisions need to be kept together.

For the booking service, an export of a customer’s class history and a Consent Manager’s record of a consent interaction are different objects. A useful support article should explain which service is available and who holds the relevant information.

A GDPR comparison needs its conditions

GDPR does contain a data-portability right, but it is conditional. The European Data Protection Board’s guidance explains the requirements concerning consent or contract, automated processing and data provided by the individual. That European framework should not be copied into an Indian statutory-rights statement without checking whether GDPR applies to the particular processing.

A company serving several markets may decide to provide a common export feature. That can be a practical product choice. Its existence does not mean every user has exactly the same statutory entitlement, and the feature’s limits should not silently narrow a right that applies in a particular jurisdiction.

Design a useful voluntary export

Even where a general DPDP portability right is absent, a business may offer exports under its service commitments or as a customer convenience. For the hypothetical booking service, a clear file containing the customer’s booking dates and attendance records may be useful. Describe the included fields, date range and any exclusions.

Check identity and delivery destination before release. Review shared bookings, staff notes and information about other customers so that a convenience feature does not become a disclosure incident. Test the file with realistic synthetic data and explain its format without promising compatibility with every competing service.

Record whether the response fulfils a legal right, a contractual promise or a voluntary service. That distinction helps future staff understand why a particular output was supplied.

Correct the script, then test the journey

Replace a blanket portability statement with accurate descriptions of available rights and services. Keep access, correction, erasure and grievances discoverable. Under the future rule 14, the published grievance-response period must not exceed ninety days; that is not a universal ninety-day deadline for every type of request.

The failure to avoid is assuming that the absence of a portability right means a customer inquiry can be dismissed. Identify the request’s substance, assess the applicable duties and commitments, and give a clear, safely delivered response.