Technology Governance Wiki - User contributions [en]

Data:India

2026-10-09T07:06:20Z

Davey Kate: /* References */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) google.com/url?q=https://www.lkslaw.com/insights/articles/dpdp-act-and-rules-a-ticking-compliance-timeline&sa=D&source=docs&ust=1791533165444212&usg=AOvVaw0UnGsQPiEAPPEtcWmOYxaR accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:34:48Z

Davey Kate: /* References */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:34:19Z

Davey Kate: /* Comparison with the European Union Data Portability Regime */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:33:35Z

Davey Kate: /* References */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why its taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:32:05Z

Davey Kate: /* Comparison with the European Union Data Portability Regime */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why its taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:24:14Z

Davey Kate: /* References */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:14:46Z

Davey Kate: /* References */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.

(34) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Akanksha Nagar, “Indian Startups Urge MCA to Ensure Transparency in Digital Competition Market Study” (Storyboard18, 23 September 2025) accessed 9 October 2026.

(36) Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Data:India

2026-10-09T06:05:46Z

Davey Kate: /* Comparison with the European Union Data Portability Regime */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Lazarotto (n 22).

(26) DPDP Act 2023 (n 6).

(27) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(28) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(29) Khandelwal (n 9).

(30) Khandelwal (n 9).

(31) [https://financialservices.gov.in/account-aggregator-framework Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.]

(32) DCB 2024 (n 19).

(33) Khandelwal (n 9).

(34) DPDP Act 2023 (n 6)

Data:India

2026-10-09T05:56:46Z

Davey Kate: /* Comparison with the European Union Data Portability Regime */

= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal. As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (25). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (26). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (27).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (28). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often. The Data Act has only been applicable since September 2025, so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (29). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (30). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (31). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (32).
India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (33). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (34).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Lazarotto (n 22).

(26) DPDP Act 2023 (n 6).

(27) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(28) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(29) Khandelwal (n 9).

(30) Khandelwal (n 9).

(31) [https://financialservices.gov.in/account-aggregator-framework Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) accessed 4 October 2026.]

(32) DCB 2024 (n 19).

(33) Khandelwal (n 9).

(34) DPDP Act 2023 (n 6)

Governance by markets

2026-10-06T17:50:31Z

Davey Kate: /* Switching costs and lock-in (Kate) */

= Glossary =
= [https://wiki.ivir.nl/index.php?title=Data_as_an_input_to_market_power Data as an input to market power] (Sergey) =In the present digital economy, data has emerged as a valuable economic commodity that entities leverage to gain a competitive edge over their rivals [[https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1478&context=nlsblr 1]]. '''Data''' is an input into production, so businesses that control data can have market power and impede the entry of potential competitors. '''Market power''' refers to a firm's ability to influence the price, output, or other market conditions in its favour, without being constrained by competitive forces [[https://www.tutor2u.net/economics/reference/what-is-meant-by-market-power 2]].'''Data as an input to market power''' means that access to information can help a business limit the competitive pressure it faces. Information about searches, clicks or purchases can improve services and advertising. If competitors cannot obtain comparable information at a reasonable cost, they may struggle to offer an attractive alternative. This can allow a platform to raise prices or worsen quality or privacy protections without losing enough business to make doing so unprofitable. This matters even when a service is free, because competition also concerns advertising charges, personal information and the choices available. Data can be used repeatedly and by several businesses without being used up. However, access can be restricted through contracts and technical controls. Nevertheless, holding a large dataset alone does not establish market power.'''Google Search''' illustrates this mechanism. Google controls over 91% of global search engine traffic [[https://www.statista.com/statistics/1381664/worldwide-all-devices-market-share-of-search-engines/ 3]] and uses information about users’ searches and the results they click to improve the relevance of its rankings. A larger volume of searches gives it more opportunities to learn, including about unusual queries that smaller search engines encounter less often. Better results can attract further use, producing additional information and reinforcing the advantage. A new search engine may therefore struggle to attract users while lacking the information needed to improve its service. Data access can constitute a significant barrier to entry when this type of analytics is necessary to participate in a market, particularly when alternatives are limited. A platform’s control over data access can shape who is able to compete with it. By determining whether, and on what terms, rivals can access that information, a platform can influence the competitive opportunities available to others. This suggests that regulation should examine access to strategically important data alongside prices and market shares. Article 6(11) of the EU Digital Markets Act [[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng#:~:text=giving%20their%20consent.-,11.%C2%A0,-The%20gatekeeper%20shall 4]] reflects this approach: certain large search providers must, on request, share specified search data with rival search providers on fair and non-discriminatory terms, with relevant personal data anonymised. The aim is to help rivals compete while protecting users. A data advantage does not, by itself, establish unlawful conduct.Would access to equivalent data enable a rival to compete effectively? The concept cannot answer this on its own. Additional data may eventually add little value, become outdated, or have substitutes. Firms also need the skills and computing resources to use it. Google’s default positions in browsers and devices can further restrict rivals’ access to users even if data become available. The unresolved issue is how much competitive advantage comes from data itself and how much comes from these other resources and arrangements. 

= Two Sided Markets (Ceren) =In two-sided markets, two sides of a market interact through an intermediary. These markets typically have some externality,<code class="mwt-code">Carl Shapiro and Hal R Varian, ''Information Rules: A Strategic Guide to the Network Economy'' (Harvard Business School Press 2010), 183.</code> where the decisions of the sides affect the other. The intermediary also has multitudes of effects on both sides, mainly identified in the related literature through its pricing.An example of a two sided market is payment systems, whereby the credit card providing bank is the intermediary between the customers and merchants. In this example, banks provide credit cards to customers to be utilized in their payments, and merchants accept payment via multiple credit card systems to accommodate payments from customers holding credit cards from such providers[https://doi.org/10.1257/jep.23.3.125 .]The main power of the intermediary materializes in their pricing toward the merchant (and the merchant’s bank in interchange fees in case of payment being transferred through different banks). Customers will be expected to be more loyal, holding a few credit cards, whereas merchants accept payment from many banks to accommodate all customers’ payment methods. Banks will provide more subsidies to customers to attract them and compete aggressively on the customer side, making their platform more desirable to work with by merchants, who will in turn be more accepting of the platform’s fees to gain the business of the larger volume of customers. However, dynamic pricing (increasing fees after gaining entry and loyalty) may be a way for these platforms to abuse their power.The concept may be derailed from these logical / analytical systems of operation or expected outcomes when public policy interferes with the market. For example, net neutrality rules regulate what internet service providers (the intermediary) can charge content providers (one side) who aim to reach the consumers (the other side). In this case the above considerations and the concept are halted.

= Switching costs and lock-in (Kate) =
'''Definition '''When you move from one product or service to another, switching costs are everything you have to either give up or spend. This can include money, time, lost contacts, etc. Lock-in is when you feel (and are) trapped by these costs that add up and you decide instead of moving products or services, it’s just easier to stay with a service, not because you want to but because it’s just too much of a hassle. This is true even if a less expensive or better service exists all because leaving the product/service just costs too much in terms of time, effort, and money. Shapiro and Varian (2010) argue that switching costs are normal in information markets and that the full cost of a switch includes what you as the customer pay and what a new supplier spends to win that customer over.  '''Example: Apple''' The more Apple products you own, the harder it is to leave. As an avid Apple user, I am absolutely stuck in their ecosystem. I have my photos in Apple’s iCloud, my group chats in iMessage, and my Apple Watch only works with an iPhone. Leaving Apple is not easy. So much so that in March 2024, the US Department of Justice sued Apple alleging it raises costs of leaving/switching phones by making messaging worse and less secure when you’re messaging with non iPhones. In June 2025, Judge Julien Neals denied Apple’s motion to dismiss and the case is still in pre-trial proceedings.  '''Governance implication''' Lock-in makes users dependent on a platform and because of that, once we’re locked in, the platform (Meta, Apple, Google, etc) can raise prices, show more ads or even provide lower quality terms. So in this way, the platform can control users because if a user wants to leave, it’s going to cost you in that the platform has already designed your exit including how you can export your data, licenses and APIs. Under the EU’s Digital Markets Act, the European Commission adopted decisions in March 2025 making Apple open nine iOS connectivity features, mostly used by devices like smartwatches, headphones and televisions. These decisions are legally binding and they focus on lock-in by lowering the cost of choosing non-Apple products. It’s worth noting, however, that they only apply in the EU. When the Commission adopted the decisions, Apple said (reported by MacTech) “It’s bad for our products and for our European users.” '''Open Question''' So what happens when the cost of leaving isn’t just your own costs as a user but also the cost of leaving family and friends behind?  If a user leaves, let’s say, Instagram, they won’t be charged to leave (they will, however, have some friction to leaving in that they’ll be asked why they’re leaving and if there’s anything Instagram can do to make them stay), but they will be leaving their family and friends that stay on the app. This is where data portability can’t really help because while you can export your photos, you can’t make your friends leave. This is part of what makes leaving a network or platform so hard. '''References:''' European Commission (2025, March 19). ''Commission provides guidance under Digital Markets Act to facilitate development of innovative products on Apple’s platforms''. https://digital-markets-act.ec.europa.eu/commission-provides-guidance-under-digital-markets-act-facilitate-development-innovative-products-2025-03-19_en MacTech (2025, March 19). ''Apple isn’t happy with the latest decisions regarding the DMA''. https://www.mactech.com/2025/03/19/apple-isnt-happy-with-the-latest-decisions-regarding-the-dma Shapiro, C. & Varian, H.R. (2010). ''Information Rules: A Strategic Guide to the Network Economy.'' Boston, MA: Harvard Business School Press. The Hill. (2025, June 30). ''Judge rejects Apple’s bid to dismiss DOJ antitrust case''. https://thehill.com/policy/technology/5380007-apple-federal-judge-antitrust-case/ The Mac Observer. (2026, September 12). ''Apple’s other antitrust fights: Where the DOJ case and the UK’s CMA stand now''. https://www.macobserver.com/news/apple-doj-antitrust-case-uk-cma-status/ U.S. Department of Justice (2024, March 21). ''Justice Department Sues Apple for Monopolizing Smartphone Markets'' [Press Release]. https://www.justice.gov/archives/opa/pr/justice-department-sues-apple-monopolizing-smartphone-markets

= Excludability and rivalrousness (Paul)  =
=== Excludability and Rivalrousness ===The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. '''Excludability''': Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.'''Rivalrousness''': Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation. 

=== AI Training and the (non-)excludability of information ===The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data. Conversely, data may be rivalrous not in its absolute depletion by consumption, but rather the benefit or competitive advantage usage of that data may confer: If all AI firms are able to train on the exact same data (all available data), the utility of that data may still increase, but the competitive advantage of possessing that data is exhausted.

==== Free-Rider Problems & Public Data ====As any party can benefit from publicly available data at no cost or low cost, the incentive for private market actors to fund its creation is comparatively weak. Consequently, public bodies (and less frequently open-source foundations and non-profits) often assume the responsibility for the provision of this type of data. A classical example is weather data and its creation by national weather agencies.

= Interoperability (Sisi) =

#What is interoperability?[[https://www.ibm.com/think/topics/interoperability 1]]Interoperability is a “standards-based” approach that enables different IT systems to communicate with minimal end-user interaction to exchange data and “share functionality”. Each system also allows the other system to “read, update, modify, and analyze” data with minimal human interaction. [[https://www.oracle.com/nl/interoperability/ 2]]Interoperability works by having different systems share data by employing the same standards for data formats (e.g., Extensible Markup Language or JavaScript Object Notation), exchange, and vocabulary to title data elements. These standards are agreed upon “in advance” by organizations, industry types, and user groups. Then, software developers build the system based on the model agreed upon.

#Concrete example from a digital technology or platformInteroperable systems are vital in healthcare, commerce, and public safety. A notable example includes the integration of Electronic Health Records (HER). This system allows different healthcare providers to securely access and share personal patient information regardless of the specific EHR system used.[[https://data.europa.eu/en/news-events/news/interoperability-solutions-bridging-systems-connected-future 3]] An example of such a system is the GNU Health Hospital Information System, which is a model employed by small private offices and large national public health systems.[[https://interoperable-europe.ec.europa.eu/collection/gnu-health/solution/gnu-health-hospital-information-system 4]]For example, a health care professional may access lab results and patient history data from various platforms to enable them to make a diagnosis.

#One governance implication: what does this concept explain about how platforms exercise power?Interoperability is a powerful tool because it helps provide a “seamless user experience” and optimizes data sharing between separate systems. It helps companies and organizations access data from multiple sources and improve efficiency, such as accelerating workflows and reducing the possibility of errors by pooling data from its sources.Interoperability standards are mandated by law on the technical side to ensure “critical systems” are compatible, especially in public safety and health. [[https://www.ibm.com/think/topics/interoperability 5]]In Europe, interoperability is governed by the European Health Data Space regulation (EHDS); the “first common EU data space dedicated to a specific sector as part of the European strategy for data.”This Regulation aims to benefit EU citizens such as patients, researchers, healthcare professionals, and industry players by establishing a common framework for the exchange of electronic health data within the EU. In addition, it enables certain data to be “reused” for public purpose and innovative scientific research. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 6]]

#Where does the concept break down or fail to explain somethingWhile the EDHS harmonizes a legal and technical framework for sharing EU data, its shortcoming is its gradual implementation. The EDHS entered into force in 2025; however, most of its obligations will not apply until 2029. This leaves four years for health care companies to use interoperability in a deregulated manner. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 7]]Furthermore, there are actual barriers to achieving full interoperability in healthcare, including data silos (which isolate data collections and hinder data exchange), lack of standardization (where one system records blood pressure as free text, another system stores it as a structured numeric value), and deficient infrastructure, which requires significant technological upgrading.The burden remains on health companies to decide which standards to adopt and how much to invest in stable technological infrastructure to strengthen their data governance and interoperability. [[https://www.tigahealth.com/how-to-overcome-healthcare-interoperability-challenges/ 8]]

= Economies of Scale (Jihae) =
===  Definition ===

= [[Economies of Scope (Mariona)]] =
= [[Network Effects (Indirect) - Sebastián]] =
= [[Monopsony - (Atmika)]] =
===== [https://wiki.ivir.nl/index.php?title=Market_tipping_-_Rodrigue Market Tipping - Rodrigue] =====
== Vertical Integration by Pablo Latorre ==
'''1. Definition'''
“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.
 
'''2. Example: Amazon as a Marketplace'''
Amazon operates the largest online marketplace (3) in the world and, thus, thousands of small and medium size enterprises depend on it to connect with their costumers. At the same time, Amazon commercializes its own products on its marketplace (4), acting as a retailer and competitor to those enterprises. Such dual role allows Amazon to exercise competitive advantages: first, it can access detailed, non-public data on the enterprises’ sales, including products, prices, and costumer behavior; and second, it can decide the rules that define the products that appear first as the result of a costumer search.
In 2022 Amazon had to commit to the European Commission to not use the enterprises’ non-public data for its retail business and to treat equally rival offers in its “Buy Box” (5). Currently, the Digital Markets Act (DMA) establishes matching general obligations for designated gatekeepers (6).
 
'''3. Governance Implication'''
“Vertical Integration” allows platforms to exercise power over enterprises through digital architecture. When a platform operates a marketplace and competes in it, its ordinary decisions on digital architecture (i.e. on algorithms, searches, products visibility) can become tools for power and competition. In a sense, platforms are the ''de facto'' private regulators of markets in which they have clear commercial interests. Such state of affairs allows to understand a strategy change in antitrust cases. Traditionally, antitrust intervenes after the harm, however regulators are moving towards ''ex ante'' conduct rules (i.e. the DMA) (7).
 
'''4. Open Question'''
“Vertical Integration” clearly explains the incentive structure that drives platforms to favor their own products through the exercise of digital architecture mediated competitive advantages. However, “Vertical Integration” assumes that the line between one product (i.e. the marketplace, the search engine) and the other (i.e. the products, the websites competing on the platform) is clear when, in practice, this is not always so. For instance, nowadays when a user search something in Google Search, Google not only provides links to websites that contain the desired information but also the desired information itself with AI-generated summaries. In this case, two possible perspectives arise: on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it. In this example, “Vertical Integration” is incapable of settling the issue because it depends on a clear distinction between one product and the other (or one market and the other) and that is absent in this case. Moreover, even if in the presented case was possible to separate one product from the other (or one market from the other), “Vertical Integration” does not provide a clear criteria to establish when an “integration” is abusive exclusion of competitors and when it is legitimate and necessary innovation.
 
'''References'''
(1) “Vertical integration” (''Cambridge Dictionary'') [https://dictionary.cambridge.org/dictionary/english/vertical-integration https://dictionary.cambridge.org/dictionary/english/vertical-integration] accessed 4 October 2026.
(2) [https://academic.oup.com/antitrust/article/6/3/355/5034073?itm_medium=sidebar&itm_source=trendmd-widget&itm_campaign=Journal_of_Antitrust_Enforcement&itm_content=Journal_of_Antitrust_Enforcement_0 Bostoen Friso, “Online Platforms and Vertical Integration: The Return of Margin Squeeze” (2018) (6) ''Journal of Antitrust Enforcement'' 355.]
(3) Lovell Keir, “Top 10 Ecommerce Marketplaces in the World: 2026 Rankings by GMV, Users & Reach” (''ServeRetail'', 2 January 2026) [https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/ https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/] accessed 4 October 2026.
(4) Ellison Mara, “What are Amazon's Brands, Explained” (''Ir Mountaintopuniversity Ng'') [https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained] accessed 4 October 2026.
(5) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2023_087_R_0005 Summary of Commission Decision of 20 December 2022 Relating to a Proceeding under Article 102 of the Treaty on the Functioning of the European Union and Article 54 of the EEA Agreement (Cases AT.40462 – Amazon Marketplace, and AT.40703 – Amazon Buy Box) (2023) OJ C87.]
(6) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG&toc=OJ%3AL%3A2022%3A265%3ATOC Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) [2022] OJ L265/1.]
(7) OECD, "Ex Ante Regulation and Competition in Digital Markets" (''OECD Roundtables on Competition Policy Papers, OECD Publishing 2021'') [https://doi.org/10.1787/c83e178d-en https://doi.org/10.1787/c83e178d-en] accessed 4 October 2026.

= Multi-homing (Juliette) =

Governance by markets

2026-10-06T17:40:16Z

Davey Kate: /* Switching costs and lock-in (Kate) */

= Glossary =
= [https://wiki.ivir.nl/index.php?title=Data_as_an_input_to_market_power Data as an input to market power] (Sergey) =In the present digital economy, data has emerged as a valuable economic commodity that entities leverage to gain a competitive edge over their rivals [[https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1478&context=nlsblr 1]]. '''Data''' is an input into production, so businesses that control data can have market power and impede the entry of potential competitors. '''Market power''' refers to a firm's ability to influence the price, output, or other market conditions in its favour, without being constrained by competitive forces [[https://www.tutor2u.net/economics/reference/what-is-meant-by-market-power 2]].'''Data as an input to market power''' means that access to information can help a business limit the competitive pressure it faces. Information about searches, clicks or purchases can improve services and advertising. If competitors cannot obtain comparable information at a reasonable cost, they may struggle to offer an attractive alternative. This can allow a platform to raise prices or worsen quality or privacy protections without losing enough business to make doing so unprofitable. This matters even when a service is free, because competition also concerns advertising charges, personal information and the choices available. Data can be used repeatedly and by several businesses without being used up. However, access can be restricted through contracts and technical controls. Nevertheless, holding a large dataset alone does not establish market power.'''Google Search''' illustrates this mechanism. Google controls over 91% of global search engine traffic [[https://www.statista.com/statistics/1381664/worldwide-all-devices-market-share-of-search-engines/ 3]] and uses information about users’ searches and the results they click to improve the relevance of its rankings. A larger volume of searches gives it more opportunities to learn, including about unusual queries that smaller search engines encounter less often. Better results can attract further use, producing additional information and reinforcing the advantage. A new search engine may therefore struggle to attract users while lacking the information needed to improve its service. Data access can constitute a significant barrier to entry when this type of analytics is necessary to participate in a market, particularly when alternatives are limited. A platform’s control over data access can shape who is able to compete with it. By determining whether, and on what terms, rivals can access that information, a platform can influence the competitive opportunities available to others. This suggests that regulation should examine access to strategically important data alongside prices and market shares. Article 6(11) of the EU Digital Markets Act [[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng#:~:text=giving%20their%20consent.-,11.%C2%A0,-The%20gatekeeper%20shall 4]] reflects this approach: certain large search providers must, on request, share specified search data with rival search providers on fair and non-discriminatory terms, with relevant personal data anonymised. The aim is to help rivals compete while protecting users. A data advantage does not, by itself, establish unlawful conduct.Would access to equivalent data enable a rival to compete effectively? The concept cannot answer this on its own. Additional data may eventually add little value, become outdated, or have substitutes. Firms also need the skills and computing resources to use it. Google’s default positions in browsers and devices can further restrict rivals’ access to users even if data become available. The unresolved issue is how much competitive advantage comes from data itself and how much comes from these other resources and arrangements. 

= Two Sided Markets (Ceren) =In two-sided markets, two sides of a market interact through an intermediary. These markets typically have some externality,<code class="mwt-code">Carl Shapiro and Hal R Varian, ''Information Rules: A Strategic Guide to the Network Economy'' (Harvard Business School Press 2010), 183.</code> where the decisions of the sides affect the other. The intermediary also has multitudes of effects on both sides, mainly identified in the related literature through its pricing.An example of a two sided market is payment systems, whereby the credit card providing bank is the intermediary between the customers and merchants. In this example, banks provide credit cards to customers to be utilized in their payments, and merchants accept payment via multiple credit card systems to accommodate payments from customers holding credit cards from such providers[https://doi.org/10.1257/jep.23.3.125 .]The main power of the intermediary materializes in their pricing toward the merchant (and the merchant’s bank in interchange fees in case of payment being transferred through different banks). Customers will be expected to be more loyal, holding a few credit cards, whereas merchants accept payment from many banks to accommodate all customers’ payment methods. Banks will provide more subsidies to customers to attract them and compete aggressively on the customer side, making their platform more desirable to work with by merchants, who will in turn be more accepting of the platform’s fees to gain the business of the larger volume of customers. However, dynamic pricing (increasing fees after gaining entry and loyalty) may be a way for these platforms to abuse their power.The concept may be derailed from these logical / analytical systems of operation or expected outcomes when public policy interferes with the market. For example, net neutrality rules regulate what internet service providers (the intermediary) can charge content providers (one side) who aim to reach the consumers (the other side). In this case the above considerations and the concept are halted.

= Switching costs and lock-in (Kate) =
'''Definition '''When you move from one product or service to another, switching costs are everything you have to either give up or spend. This can include money, time, lost contacts, etc. Lock-in is when you feel (and are) trapped by these costs that add up and you decide instead of moving products or services, it’s just easier to stay with a service, not because you want to but because it’s just too much of a hassle. This is true even if a less expensive or better service exists all because leaving the product/service just costs too much in terms of time, effort, and money. Shapiro and Varian (2010) argue that switching costs are normal in information markets and that the full cost of a switch includes what you as the customer pays and what a new supplier spends to win that customer over.  '''Example: Apple''' The more Apple products you own, the harder it is to leave. As an avid Apple user, I am absolutely stuck in their ecosystem. I have my photos in Apple’s iCloud, my group chats in iMessage, and my Apple Watch only works with an iPhone. Leaving Apple is not easy. So much so that in March 2024, the US Department of Justice sued Apple alleging it raises costs of leaving/switching phones by making messaging worse and less secure when you’re messaging with non iPhones. In June 2025, Judge Julien Neals denied Apple’s motion to dismiss and the case is still in pre-trial proceedings.  '''Governance implication''' Lock-in makes users dependent on a platform and because of that, once we’re locked in, the platform (Meta, Apple, Google, etc) can raise prices, show more ads or even provide lower quality terms. So in this way, the platform can control users because if a user wants to leave, it’s going to cost you in that the platform has already designed your exit including how you can export your data, licenses and APIs. Under the EU’s Digital Markets Act, the European Commission adopted decisions in March 2025 making Apple open nine iOS connectivity features, mostly used by devices like smartwatches, headphones and televisions. Since these decisions are legally binding, they focus on lock-in by lowering the cost of choosing non-Apple products. It’s worth noting, however, that they only apply in the EU. When the Commission adopted the decisions, Apple said (reported by MacTech) “It’s bad for our products and for our European users.” '''Open Question''' So what happens when the cost of leaving isn’t just your own costs as a user but also the cost of leaving family and friends behind?  If a user leaves, let’s say Instagram, they won’t be charged to leave (they will, however, have some friction to leaving in that they’ll be asked why they’re leaving and if there’s anything Instagram can do to make them stay), but they will be leaving their family and friends that stay on the app. This is where data portability can’t really help because while you can export your photos, you can’t make your friends leave. This is part of what makes leaving a network or platform so hard. '''References:''' European Commission (2025, March 19). ''Commission provides guidance under Digital Markets Act to facilitate development of innovative products on Apple’s platforms''. https://digital-markets-act.ec.europa.eu/commission-provides-guidance-under-digital-markets-act-facilitate-development-innovative-products-2025-03-19_en MacTech (2025, March 19). ''Apple isn’t happy with the latest decisions regarding the DMA''. https://www.mactech.com/2025/03/19/apple-isnt-happy-with-the-latest-decisions-regarding-the-dma Shapiro, C. & Varian, H.R. (2010). ''Information Rules: A Strategic Guide to the Network Economy.'' Boston, MA: Harvard Business School Press. The Hill. (2025, June 30). ''Judge rejects Apple’s bid to dismiss DOJ antitrust case''. https://thehill.com/policy/technology/5380007-apple-federal-judge-antitrust-case/ The Mac Observer. (2026, September 12). ''Apple’s other antitrust fights: Where the DOJ case and the UK’s CMA stand now''. https://www.macobserver.com/news/apple-doj-antitrust-case-uk-cma-status/ U.S. Department of Justice (2024, March 21). ''Justice Department Sues Apple for Monopolizing Smartphone Markets'' [Press Release]. https://www.justice.gov/archives/opa/pr/justice-department-sues-apple-monopolizing-smartphone-markets

= Excludability and rivalrousness (Paul)  =
=== Excludability and Rivalrousness ===The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. '''Excludability''': Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.'''Rivalrousness''': Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation. 

=== AI Training and the (non-)excludability of information ===The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data. Conversely, data may be rivalrous not in its absolute depletion by consumption, but rather the benefit or competitive advantage usage of that data may confer: If all AI firms are able to train on the exact same data (all available data), the utility of that data may still increase, but the competitive advantage of possessing that data is exhausted.

==== Free-Rider Problems & Public Data ====As any party can benefit from publicly available data at no cost or low cost, the incentive for private market actors to fund its creation is comparatively weak. Consequently, public bodies (and less frequently open-source foundations and non-profits) often assume the responsibility for the provision of this type of data. A classical example is weather data and its creation by national weather agencies.

= Interoperability (Sisi) =

#What is interoperability?[[https://www.ibm.com/think/topics/interoperability 1]]Interoperability is a “standards-based” approach that enables different IT systems to communicate with minimal end-user interaction to exchange data and “share functionality”. Each system also allows the other system to “read, update, modify, and analyze” data with minimal human interaction. [[https://www.oracle.com/nl/interoperability/ 2]]Interoperability works by having different systems share data by employing the same standards for data formats (e.g., Extensible Markup Language or JavaScript Object Notation), exchange, and vocabulary to title data elements. These standards are agreed upon “in advance” by organizations, industry types, and user groups. Then, software developers build the system based on the model agreed upon.

#Concrete example from a digital technology or platformInteroperable systems are vital in healthcare, commerce, and public safety. A notable example includes the integration of Electronic Health Records (HER). This system allows different healthcare providers to securely access and share personal patient information regardless of the specific EHR system used.[[https://data.europa.eu/en/news-events/news/interoperability-solutions-bridging-systems-connected-future 3]] An example of such a system is the GNU Health Hospital Information System, which is a model employed by small private offices and large national public health systems.[[https://interoperable-europe.ec.europa.eu/collection/gnu-health/solution/gnu-health-hospital-information-system 4]]For example, a health care professional may access lab results and patient history data from various platforms to enable them to make a diagnosis.

#One governance implication: what does this concept explain about how platforms exercise power?Interoperability is a powerful tool because it helps provide a “seamless user experience” and optimizes data sharing between separate systems. It helps companies and organizations access data from multiple sources and improve efficiency, such as accelerating workflows and reducing the possibility of errors by pooling data from its sources.Interoperability standards are mandated by law on the technical side to ensure “critical systems” are compatible, especially in public safety and health. [[https://www.ibm.com/think/topics/interoperability 5]]In Europe, interoperability is governed by the European Health Data Space regulation (EHDS); the “first common EU data space dedicated to a specific sector as part of the European strategy for data.”This Regulation aims to benefit EU citizens such as patients, researchers, healthcare professionals, and industry players by establishing a common framework for the exchange of electronic health data within the EU. In addition, it enables certain data to be “reused” for public purpose and innovative scientific research. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 6]]

#Where does the concept break down or fail to explain somethingWhile the EDHS harmonizes a legal and technical framework for sharing EU data, its shortcoming is its gradual implementation. The EDHS entered into force in 2025; however, most of its obligations will not apply until 2029. This leaves four years for health care companies to use interoperability in a deregulated manner. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 7]]Furthermore, there are actual barriers to achieving full interoperability in healthcare, including data silos (which isolate data collections and hinder data exchange), lack of standardization (where one system records blood pressure as free text, another system stores it as a structured numeric value), and deficient infrastructure, which requires significant technological upgrading.The burden remains on health companies to decide which standards to adopt and how much to invest in stable technological infrastructure to strengthen their data governance and interoperability. [[https://www.tigahealth.com/how-to-overcome-healthcare-interoperability-challenges/ 8]]

= Economies of Scale (Jihae) =
===  Definition ===

= [[Economies of Scope (Mariona)]] =
= [[Network Effects (Indirect) - Sebastián]] =
= [[Monopsony - (Atmika)]] =
===== [https://wiki.ivir.nl/index.php?title=Market_tipping_-_Rodrigue Market Tipping - Rodrigue] =====
== Vertical Integration by Pablo Latorre ==
'''1. Definition'''
“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.
 
'''2. Example: Amazon as a Marketplace'''
Amazon operates the largest online marketplace (3) in the world and, thus, thousands of small and medium size enterprises depend on it to connect with their costumers. At the same time, Amazon commercializes its own products on its marketplace (4), acting as a retailer and competitor to those enterprises. Such dual role allows Amazon to exercise competitive advantages: first, it can access detailed, non-public data on the enterprises’ sales, including products, prices, and costumer behavior; and second, it can decide the rules that define the products that appear first as the result of a costumer search.
In 2022 Amazon had to commit to the European Commission to not use the enterprises’ non-public data for its retail business and to treat equally rival offers in its “Buy Box” (5). Currently, the Digital Markets Act (DMA) establishes matching general obligations for designated gatekeepers (6).
 
'''3. Governance Implication'''
“Vertical Integration” allows platforms to exercise power over enterprises through digital architecture. When a platform operates a marketplace and competes in it, its ordinary decisions on digital architecture (i.e. on algorithms, searches, products visibility) can become tools for power and competition. In a sense, platforms are the ''de facto'' private regulators of markets in which they have clear commercial interests. Such state of affairs allows to understand a strategy change in antitrust cases. Traditionally, antitrust intervenes after the harm, however regulators are moving towards ''ex ante'' conduct rules (i.e. the DMA) (7).
 
'''4. Open Question'''
“Vertical Integration” clearly explains the incentive structure that drives platforms to favor their own products through the exercise of digital architecture mediated competitive advantages. However, “Vertical Integration” assumes that the line between one product (i.e. the marketplace, the search engine) and the other (i.e. the products, the websites competing on the platform) is clear when, in practice, this is not always so. For instance, nowadays when a user search something in Google Search, Google not only provides links to websites that contain the desired information but also the desired information itself with AI-generated summaries. In this case, two possible perspectives arise: on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it. In this example, “Vertical Integration” is incapable of settling the issue because it depends on a clear distinction between one product and the other (or one market and the other) and that is absent in this case. Moreover, even if in the presented case was possible to separate one product from the other (or one market from the other), “Vertical Integration” does not provide a clear criteria to establish when an “integration” is abusive exclusion of competitors and when it is legitimate and necessary innovation.
 
'''References'''
(1) “Vertical integration” (''Cambridge Dictionary'') [https://dictionary.cambridge.org/dictionary/english/vertical-integration https://dictionary.cambridge.org/dictionary/english/vertical-integration] accessed 4 October 2026.
(2) [https://academic.oup.com/antitrust/article/6/3/355/5034073?itm_medium=sidebar&itm_source=trendmd-widget&itm_campaign=Journal_of_Antitrust_Enforcement&itm_content=Journal_of_Antitrust_Enforcement_0 Bostoen Friso, “Online Platforms and Vertical Integration: The Return of Margin Squeeze” (2018) (6) ''Journal of Antitrust Enforcement'' 355.]
(3) Lovell Keir, “Top 10 Ecommerce Marketplaces in the World: 2026 Rankings by GMV, Users & Reach” (''ServeRetail'', 2 January 2026) [https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/ https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/] accessed 4 October 2026.
(4) Ellison Mara, “What are Amazon's Brands, Explained” (''Ir Mountaintopuniversity Ng'') [https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained] accessed 4 October 2026.
(5) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2023_087_R_0005 Summary of Commission Decision of 20 December 2022 Relating to a Proceeding under Article 102 of the Treaty on the Functioning of the European Union and Article 54 of the EEA Agreement (Cases AT.40462 – Amazon Marketplace, and AT.40703 – Amazon Buy Box) (2023) OJ C87.]
(6) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG&toc=OJ%3AL%3A2022%3A265%3ATOC Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) [2022] OJ L265/1.]
(7) OECD, "Ex Ante Regulation and Competition in Digital Markets" (''OECD Roundtables on Competition Policy Papers, OECD Publishing 2021'') [https://doi.org/10.1787/c83e178d-en https://doi.org/10.1787/c83e178d-en] accessed 4 October 2026.

= Multi-homing (Juliette) =

Talk:Network Effects (Indirect) - Sebastián

2026-10-06T17:38:02Z

Davey Kate: Created page with "Great job! Question for you regarding Uber eats/Uber One, do you think in addition to leveraging their size so they can offer something like Uber One, that they purposely design a difficult exit? -Kate"

Great job! Question for you regarding Uber eats/Uber One, do you think in addition to leveraging their size so they can offer something like Uber One, that they purposely design a difficult exit? -Kate

Talk:Governance by markets

2026-10-06T17:36:05Z

Davey Kate:

 Very interesting! "on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it." What do you make of Google doing this? I think it's the former, they don't want us to leave their search engine ever (at all) so they're trying to keep us there with AI integration so we can ask it our questions more in a 3-D way than just regular search on Google. Curious as to your thoughts. -Kate

Talk:Governance by markets

2026-10-06T17:35:50Z

Davey Kate: Created page with " Very interesting! "on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it." What do you make of Google doing this? I think it's the former, they don't want us to leave their search engine ever (at all) so they're trying t..."

Talk:Data as an input to market power

2026-10-06T17:31:48Z

Davey Kate: Created page with "This fact blew my mind: "Google controls over 91% of global search engine traffic" do you think search engines like Duck duck go can ever compete with Google simply because they aren't tracking us like Google? Do you think there could ever be a true search competitor to Google or are they in fact a monopoly? - Kate "

This fact blew my mind: "Google controls over 91% of global search engine traffic" do you think search engines like Duck duck go can ever compete with Google simply because they aren't tracking us like Google? Do you think there could ever be a true search competitor to Google or are they in fact a monopoly? - Kate 

Governance by markets

2026-10-06T17:27:00Z

Davey Kate: /* Switching costs and lock-in (Kate) */

= Glossary =
= [https://wiki.ivir.nl/index.php?title=Data_as_an_input_to_market_power Data as an input to market power] (Sergey) =In the present digital economy, data has emerged as a valuable economic commodity that entities leverage to gain a competitive edge over their rivals [[https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1478&context=nlsblr 1]]. '''Data''' is an input into production, so businesses that control data can have market power and impede the entry of potential competitors. '''Market power''' refers to a firm's ability to influence the price, output, or other market conditions in its favour, without being constrained by competitive forces [[https://www.tutor2u.net/economics/reference/what-is-meant-by-market-power 2]].'''Data as an input to market power''' means that access to information can help a business limit the competitive pressure it faces. Information about searches, clicks or purchases can improve services and advertising. If competitors cannot obtain comparable information at a reasonable cost, they may struggle to offer an attractive alternative. This can allow a platform to raise prices or worsen quality or privacy protections without losing enough business to make doing so unprofitable. This matters even when a service is free, because competition also concerns advertising charges, personal information and the choices available. Data can be used repeatedly and by several businesses without being used up. However, access can be restricted through contracts and technical controls. Nevertheless, holding a large dataset alone does not establish market power.'''Google Search''' illustrates this mechanism. Google controls over 91% of global search engine traffic [[https://www.statista.com/statistics/1381664/worldwide-all-devices-market-share-of-search-engines/ 3]] and uses information about users’ searches and the results they click to improve the relevance of its rankings. A larger volume of searches gives it more opportunities to learn, including about unusual queries that smaller search engines encounter less often. Better results can attract further use, producing additional information and reinforcing the advantage. A new search engine may therefore struggle to attract users while lacking the information needed to improve its service. Data access can constitute a significant barrier to entry when this type of analytics is necessary to participate in a market, particularly when alternatives are limited. A platform’s control over data access can shape who is able to compete with it. By determining whether, and on what terms, rivals can access that information, a platform can influence the competitive opportunities available to others. This suggests that regulation should examine access to strategically important data alongside prices and market shares. Article 6(11) of the EU Digital Markets Act [[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng#:~:text=giving%20their%20consent.-,11.%C2%A0,-The%20gatekeeper%20shall 4]] reflects this approach: certain large search providers must, on request, share specified search data with rival search providers on fair and non-discriminatory terms, with relevant personal data anonymised. The aim is to help rivals compete while protecting users. A data advantage does not, by itself, establish unlawful conduct.Would access to equivalent data enable a rival to compete effectively? The concept cannot answer this on its own. Additional data may eventually add little value, become outdated, or have substitutes. Firms also need the skills and computing resources to use it. Google’s default positions in browsers and devices can further restrict rivals’ access to users even if data become available. The unresolved issue is how much competitive advantage comes from data itself and how much comes from these other resources and arrangements. 

= Two Sided Markets (Ceren) =In two-sided markets, two sides of a market interact through an intermediary. These markets typically have some externality,<code class="mwt-code">Carl Shapiro and Hal R Varian, ''Information Rules: A Strategic Guide to the Network Economy'' (Harvard Business School Press 2010), 183.</code> where the decisions of the sides affect the other. The intermediary also has multitudes of effects on both sides, mainly identified in the related literature through its pricing.An example of a two sided market is payment systems, whereby the credit card providing bank is the intermediary between the customers and merchants. In this example, banks provide credit cards to customers to be utilized in their payments, and merchants accept payment via multiple credit card systems to accommodate payments from customers holding credit cards from such providers[https://doi.org/10.1257/jep.23.3.125 .]The main power of the intermediary materializes in their pricing toward the merchant (and the merchant’s bank in interchange fees in case of payment being transferred through different banks). Customers will be expected to be more loyal, holding a few credit cards, whereas merchants accept payment from many banks to accommodate all customers’ payment methods. Banks will provide more subsidies to customers to attract them and compete aggressively on the customer side, making their platform more desirable to work with by merchants, who will in turn be more accepting of the platform’s fees to gain the business of the larger volume of customers. However, dynamic pricing (increasing fees after gaining entry and loyalty) may be a way for these platforms to abuse their power.The concept may be derailed from these logical / analytical systems of operation or expected outcomes when public policy interferes with the market. For example, net neutrality rules regulate what internet service providers (the intermediary) can charge content providers (one side) who aim to reach the consumers (the other side). In this case the above considerations and the concept are halted.

= Switching costs and lock-in (Kate) =
'''Definition '''When you move from one product or service to another, switching costs are everything you have to either give up or spend. This can include money, time, lost contacts, etc. Lock-in is when you feel (and are) trapped by these costs that add up and you decide instead of moving products or services, it’s just easier to stay with a service, not because you want to but because it’s just too much of a hassle. This is true even if a less expensive or better service exists all because leaving the product/service just costs too much in terms of time, effort, and money. Shapiro and Varian (2010) argue that switching costs are normal in information markets and that the full cost of a switch includes what you as the customer pays and what a new supplier spends to win that customer over.  

'''Example: Apple''' The more Apple products you own, the harder it is to leave. As an avid Apple user, I am absolutely stuck in their ecosystem. I have my photos in Apple’s iCloud, my group chats in iMessage, and my Apple Watch only works with an iPhone. Leaving Apple is not easy. So much so that in March 2024, the US Department of Justice sued Apple alleging it raises costs of leaving/switching phones by making messaging worse and less secure when you’re messaging with non iPhones. In June 2025, Judge Julien Neals denied Apple’s motion to dismiss and the case is still in pre-trial proceedings.  

'''Governance implication''' Lock-in makes users dependent on a platform and because of that, once we’re locked in, the platform (Meta, Apple, Google, etc) can raise prices, show more ads or even provide lower quality terms. So in this way, the platform can control users because if a user wants to leave, it’s going to cost you in that the platform has already designed your exit including how you can export your data, licenses and APIs. Under the EU’s Digital Markets Act, the European Commission adopted decisions in March 2025 making Apple open nine iOS connectivity features, mostly used by devices like smartwatches, headphones and televisions. Since these decisions are legally binding, they focus on lock-in by lowering the cost of choosing non-Apple products. It’s worth noting, however, that they only apply in the EU. When the Commission adopted the decisions, Apple said (reported by MacTech) “It’s bad for our products and for our European users.” '''Open Question''' So what happens when the cost of leaving isn’t just your own costs as a user but also the cost of leaving family and friends behind?  If a user leaves, let’s say Instagram, they won’t be charged to leave (they will, however, have some friction to leaving in that they’ll be asked why they’re leaving and if there’s anything Instagram can do to make them stay), but they will be leaving their family and friends that stay on the app. This is where data portability can’t really help because while you can export your photos, you can’t make your friends leave. This is part of what makes leaving a network or platform so hard. '''References:''' European Commission (2025, March 19). ''Commission provides guidance under Digital Markets Act to facilitate development of innovative products on Apple’s platforms''. https://digital-markets-act.ec.europa.eu/commission-provides-guidance-under-digital-markets-act-facilitate-development-innovative-products-2025-03-19_en MacTech (2025, March 19). ''Apple isn’t happy with the latest decisions regarding the DMA''. https://www.mactech.com/2025/03/19/apple-isnt-happy-with-the-latest-decisions-regarding-the-dma Shapiro, C. & Varian, H.R. (2010). ''Information Rules: A Strategic Guide to the Network Economy.'' Boston, MA: Harvard Business School Press. The Hill. (2025, June 30). ''Judge rejects Apple’s bid to dismiss DOJ antitrust case''. https://thehill.com/policy/technology/5380007-apple-federal-judge-antitrust-case/ The Mac Observer. (2026, September 12). ''Apple’s other antitrust fights: Where the DOJ case and the UK’s CMA stand now''. https://www.macobserver.com/news/apple-doj-antitrust-case-uk-cma-status/ U.S. Department of Justice (2024, March 21). ''Justice Department Sues Apple for Monopolizing Smartphone Markets'' [Press Release]. https://www.justice.gov/archives/opa/pr/justice-department-sues-apple-monopolizing-smartphone-markets

= Excludability and rivalrousness (Paul)  =
=== Excludability and Rivalrousness ===The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. '''Excludability''': Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.'''Rivalrousness''': Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation. 

=== AI Training and the (non-)excludability of information ===The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data. Conversely, data may be rivalrous not in its absolute depletion by consumption, but rather the benefit or competitive advantage usage of that data may confer: If all AI firms are able to train on the exact same data (all available data), the utility of that data may still increase, but the competitive advantage of possessing that data is exhausted.

==== Free-Rider Problems & Public Data ====As any party can benefit from publicly available data at no cost or low cost, the incentive for private market actors to fund its creation is comparatively weak. Consequently, public bodies (and less frequently open-source foundations and non-profits) often assume the responsibility for the provision of this type of data. A classical example is weather data and its creation by national weather agencies.

= Interoperability (Sisi) =

#What is interoperability?[[https://www.ibm.com/think/topics/interoperability 1]]Interoperability is a “standards-based” approach that enables different IT systems to communicate with minimal end-user interaction to exchange data and “share functionality”. Each system also allows the other system to “read, update, modify, and analyze” data with minimal human interaction. [[https://www.oracle.com/nl/interoperability/ 2]]Interoperability works by having different systems share data by employing the same standards for data formats (e.g., Extensible Markup Language or JavaScript Object Notation), exchange, and vocabulary to title data elements. These standards are agreed upon “in advance” by organizations, industry types, and user groups. Then, software developers build the system based on the model agreed upon.

#Concrete example from a digital technology or platformInteroperable systems are vital in healthcare, commerce, and public safety. A notable example includes the integration of Electronic Health Records (HER). This system allows different healthcare providers to securely access and share personal patient information regardless of the specific EHR system used.[[https://data.europa.eu/en/news-events/news/interoperability-solutions-bridging-systems-connected-future 3]] An example of such a system is the GNU Health Hospital Information System, which is a model employed by small private offices and large national public health systems.[[https://interoperable-europe.ec.europa.eu/collection/gnu-health/solution/gnu-health-hospital-information-system 4]]For example, a health care professional may access lab results and patient history data from various platforms to enable them to make a diagnosis.

#One governance implication: what does this concept explain about how platforms exercise power?Interoperability is a powerful tool because it helps provide a “seamless user experience” and optimizes data sharing between separate systems. It helps companies and organizations access data from multiple sources and improve efficiency, such as accelerating workflows and reducing the possibility of errors by pooling data from its sources.Interoperability standards are mandated by law on the technical side to ensure “critical systems” are compatible, especially in public safety and health. [[https://www.ibm.com/think/topics/interoperability 5]]In Europe, interoperability is governed by the European Health Data Space regulation (EHDS); the “first common EU data space dedicated to a specific sector as part of the European strategy for data.”This Regulation aims to benefit EU citizens such as patients, researchers, healthcare professionals, and industry players by establishing a common framework for the exchange of electronic health data within the EU. In addition, it enables certain data to be “reused” for public purpose and innovative scientific research. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 6]]

#Where does the concept break down or fail to explain somethingWhile the EDHS harmonizes a legal and technical framework for sharing EU data, its shortcoming is its gradual implementation. The EDHS entered into force in 2025; however, most of its obligations will not apply until 2029. This leaves four years for health care companies to use interoperability in a deregulated manner. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 7]]Furthermore, there are actual barriers to achieving full interoperability in healthcare, including data silos (which isolate data collections and hinder data exchange), lack of standardization (where one system records blood pressure as free text, another system stores it as a structured numeric value), and deficient infrastructure, which requires significant technological upgrading.The burden remains on health companies to decide which standards to adopt and how much to invest in stable technological infrastructure to strengthen their data governance and interoperability. [[https://www.tigahealth.com/how-to-overcome-healthcare-interoperability-challenges/ 8]]

= Economies of Scale (Jihae) =
===  Definition ===

= [[Economies of Scope (Mariona)]] =
= [[Network Effects (Indirect) - Sebastián]] =
= [[Monopsony - (Atmika)]] =
===== [https://wiki.ivir.nl/index.php?title=Market_tipping_-_Rodrigue Market Tipping - Rodrigue] =====
== Vertical Integration by Pablo Latorre ==
'''1. Definition'''
“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.
 
'''2. Example: Amazon as a Marketplace'''
Amazon operates the largest online marketplace (3) in the world and, thus, thousands of small and medium size enterprises depend on it to connect with their costumers. At the same time, Amazon commercializes its own products on its marketplace (4), acting as a retailer and competitor to those enterprises. Such dual role allows Amazon to exercise competitive advantages: first, it can access detailed, non-public data on the enterprises’ sales, including products, prices, and costumer behavior; and second, it can decide the rules that define the products that appear first as the result of a costumer search.
In 2022 Amazon had to commit to the European Commission to not use the enterprises’ non-public data for its retail business and to treat equally rival offers in its “Buy Box” (5). Currently, the Digital Markets Act (DMA) establishes matching general obligations for designated gatekeepers (6).
 
'''3. Governance Implication'''
“Vertical Integration” allows platforms to exercise power over enterprises through digital architecture. When a platform operates a marketplace and competes in it, its ordinary decisions on digital architecture (i.e. on algorithms, searches, products visibility) can become tools for power and competition. In a sense, platforms are the ''de facto'' private regulators of markets in which they have clear commercial interests. Such state of affairs allows to understand a strategy change in antitrust cases. Traditionally, antitrust intervenes after the harm, however regulators are moving towards ''ex ante'' conduct rules (i.e. the DMA) (7).
 
'''4. Open Question'''
“Vertical Integration” clearly explains the incentive structure that drives platforms to favor their own products through the exercise of digital architecture mediated competitive advantages. However, “Vertical Integration” assumes that the line between one product (i.e. the marketplace, the search engine) and the other (i.e. the products, the websites competing on the platform) is clear when, in practice, this is not always so. For instance, nowadays when a user search something in Google Search, Google not only provides links to websites that contain the desired information but also the desired information itself with AI-generated summaries. In this case, two possible perspectives arise: on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it. In this example, “Vertical Integration” is incapable of settling the issue because it depends on a clear distinction between one product and the other (or one market and the other) and that is absent in this case. Moreover, even if in the presented case was possible to separate one product from the other (or one market from the other), “Vertical Integration” does not provide a clear criteria to establish when an “integration” is abusive exclusion of competitors and when it is legitimate and necessary innovation.
 
'''References'''
(1) “Vertical integration” (''Cambridge Dictionary'') [https://dictionary.cambridge.org/dictionary/english/vertical-integration https://dictionary.cambridge.org/dictionary/english/vertical-integration] accessed 4 October 2026.
(2) [https://academic.oup.com/antitrust/article/6/3/355/5034073?itm_medium=sidebar&itm_source=trendmd-widget&itm_campaign=Journal_of_Antitrust_Enforcement&itm_content=Journal_of_Antitrust_Enforcement_0 Bostoen Friso, “Online Platforms and Vertical Integration: The Return of Margin Squeeze” (2018) (6) ''Journal of Antitrust Enforcement'' 355.]
(3) Lovell Keir, “Top 10 Ecommerce Marketplaces in the World: 2026 Rankings by GMV, Users & Reach” (''ServeRetail'', 2 January 2026) [https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/ https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/] accessed 4 October 2026.
(4) Ellison Mara, “What are Amazon's Brands, Explained” (''Ir Mountaintopuniversity Ng'') [https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained] accessed 4 October 2026.
(5) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2023_087_R_0005 Summary of Commission Decision of 20 December 2022 Relating to a Proceeding under Article 102 of the Treaty on the Functioning of the European Union and Article 54 of the EEA Agreement (Cases AT.40462 – Amazon Marketplace, and AT.40703 – Amazon Buy Box) (2023) OJ C87.]
(6) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG&toc=OJ%3AL%3A2022%3A265%3ATOC Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) [2022] OJ L265/1.]
(7) OECD, "Ex Ante Regulation and Competition in Digital Markets" (''OECD Roundtables on Competition Policy Papers, OECD Publishing 2021'') [https://doi.org/10.1787/c83e178d-en https://doi.org/10.1787/c83e178d-en] accessed 4 October 2026.

= Multi-homing (Juliette) =

Governance by markets

2026-10-02T12:20:11Z

Davey Kate:

= Glossary =
= Data as an input to market power (Sergey) =
= Two Sided Markets (Ceren) =
= Switching costs and lock-in (Kate) =
[[File:Untitled Diagram.drawio (1).png|300px|thumb|Goods Matrix]]

= Excludability and rivalrousness (Paul) =
Excludability and Rivalrousness

 The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. 

 Excludability: Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.
Rivalrousness: Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. 

 Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation. 
AI Training and the (non-)excludability of information.
The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data.

Talk:Social-Media Governance in the EU - by Sergey Abramov

2026-09-22T20:54:49Z

Davey Kate: Created page with "Paul, really enjoyed your review of social media governance. I'm curious about your thoughts on Meta's decision to end its third-party fact checking in favor of Community Notes?"

Paul, really enjoyed your review of social media governance. I'm curious about your thoughts on Meta's decision to end its third-party fact checking in favor of Community Notes?

Talk:Artificial General Intelligence - By Sebastián Muller

2026-09-22T20:49:09Z

Davey Kate:

Hi Seba, this is a superbly written article, especially from an informational standpoint. The only thing I might suggest is that you add headings for the sake of navigational clarity. - Paul Seba, really well done. I'm curious how you think laws will evolve with AGI and do you think they will happen too late? As we discussed briefly today, I think AGI already exists they're just keeping it under wraps.

Antropic's Fable 5.1 (Kate Davey)

2026-09-22T20:44:12Z

Davey Kate:

Kate Davey September 21, 2026 A Patchwork of Governance: Anthropic’s Fable 5.1 Word count: 491

 '''1. AI Model: Claude Fable 5.1: Anthropic board: non-state '''Source of authority: Anthropic creates its own authority through creating the infrastructure of Claude including its own safeguards.
Governing instrument: Anthropic governs itself with its own board and [https://www-cdn.anthropic.com/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf Responsible Scaling Policy] (RSP). Its latest [https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf risk report] is from August 2026 and its most updated Responsible Scaling Policy is from July 8, 2026. Interest/Value it purports to protect: According to its own RSP, it purports “Anticipating and securing against emerging threats that accompany increasingly powerful models.” In other words, preventing misuse and catastrophic risk. 
One weakness in its accountability: Anthropic governs itself, it decides when and if external review happens. '''2. SB-53 Artificial intelligence models: large developers: California State/Public''' Source of authority: [https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CONS&division=&title=&part=&chapter=&article=IV Article IV of California Constitution], the “Artificial intelligence models: large developers” bill passed both houses and Governor Newsom signed it September 29, 2025. Governing instrument: [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22757.10 Transparency in Frontier Artificial Intelligence Act].
Interest/Value it purports to protect: The public from “catastrophic risk” as described from [https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53 Chapter 138], Legislative Counsel's Digest, by requiring “a summary of any assessment of catastrophic risk, as defined, resulting from internal use of its frontier models, as specified.”
One weakness in its accountability: AI companies, including Anthropic, create their own framework against which they are evaluated. Section (1) 22757.12. (a).

 '''3. Executive Order 14409: Federal/Public''' Source of authority: [https://www.archives.gov/founding-docs/constitution-transcript Article II of the Constitution]. It is worth noting there is no comprehensive federal law governing AI in the United States, just Executive Orders. Governing instrument: [https://www.federalregister.gov/documents/2026/06/05/2026-11415/promoting-advanced-artificial-intelligence-innovation-and-security Executive Order 14409]
Interest/Value it purports to protect: National security & cybersecurity “(a) develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a “covered frontier model” for the purposes of this order, sharing such assessments with AI developers and researchers as appropriate.”
One weakness in its accountability: Benchmarks judging the models are classified and set by NSA director, and it's worth noting when Anthropic refused to allow Claude to be used for mass surveillance or autonomous weapons, the Department of Defense called it a "supply chain risk" under the Federal Acquisition Supply Chain Security Act [https://www.govinfo.gov/link/uscode/10/3252 10 U.S.C. § 3252] and [https://www.govinfo.gov/link/uscode/41/4713 41 U.S.C. § 4713], a designation a federal judge blocked in August 2026. 

 '''4. European Union: Regulation (EU) 2024/1689 of the European Parliament and of the Council'''Source of authority: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act / Treaty on the Functioning of the EU] [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj Articles 16] and [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_114/oj 114] Governing instrument: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act, Regulation (EU) 2024/1689], Chapter V on general AI models. 
Interest/Value it purports to protect: Article 1 (1) “to promote the uptake of human-centric and trustworthy artificial intelligence (AI)” to ensure the protection of health, safety, and fundamental rights.
One weakness in its accountability: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng Article 43 (2)] "Conformity assessment" allows many high-risk systems to be checked by AI companies with no notified body.

Antropic's Fable 5.1 (Kate Davey)

2026-09-22T20:36:40Z

Davey Kate:

Kate Davey September 21, 2026 A Patchwork of Governance: Anthropic’s Fable 5.1 Word count: 491

 '''1. AI Model: Claude Fable 5.1: Anthropic board: non-state '''Source of authority: Anthropic creates its own authority as a Delaware based-corporation and through creating the infrastructure of Claude including its own safeguards.
Governing instrument: Anthropic governs itself with its own board and [https://www-cdn.anthropic.com/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf Responsible Scaling Policy] (RSP). Its latest [https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf risk report] is from August 2026 and its most updated Responsible Scaling Policy is from July 8, 2026. Interest/Value it purports to protect: According to its own RSP it purports “Anticipating and securing against emerging threats that accompany increasingly powerful models.” In other words, preventing misuse and catastrophic risk. 
One weakness in its accountability: Anthropic governs itself, it decides when and if external review happens. '''2. SB-53 Artificial intelligence models: large developers: California State/Public''' Source of authority: [https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CONS&division=&title=&part=&chapter=&article=IV Article IV of California Constitution], the “Artificial intelligence models: large developers” bill passed both houses and Governor Newsom signed it September 29, 2025. Governing instrument: Transparency in Frontier Artificial Intelligence Act.
Interest/Value it purports to protect: The public from “catastrophic risk” as described from [https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53 Chapter 138], Legislative Counsel's Digest, by requiring “a summary of any assessment of catastrophic risk, as defined, resulting from internal use of its frontier models, as specified.”
One weakness in its accountability: AI companies, including Anthropic, create their own framework against which they are evaluated. Section (1) 22757.12. (a).

 '''3. Executive Order 14409: Federal/Public''' Source of authority: [https://www.archives.gov/founding-docs/constitution-transcript Article II of the Constitution]. It is worth noting there is no comprehensive federal law governing AI in the United States, just Executive Orders. Governing instrument: [https://www.federalregister.gov/documents/2026/06/05/2026-11415/promoting-advanced-artificial-intelligence-innovation-and-security Executive Order 14409]
Interest/Value it purports to protect: National security & cybersecurity “(a) develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a “covered frontier model” for the purposes of this order, sharing such assessments with AI developers and researchers as appropriate.”
One weakness in its accountability: Benchmarks judging the models are classified and set by NSA director, and it's worth noting when Anthropic refused to allow Claude to be used for mass surveillance or autonomous weapons, the Department of Defense called it a "supply chain risk" under the Federal Acquisition Supply Chain Security Act [https://www.govinfo.gov/link/uscode/10/3252 10 U.S.C. § 3252] and [https://www.govinfo.gov/link/uscode/41/4713 41 U.S.C. § 4713], a designation a federal judge blocked in August 2026. 

 '''4. European Union: Regulation (EU) 2024/1689 of the European Parliament and of the Council'''Source of authority: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act / Treaty on the Functioning of the EU] [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj Articles 16] and [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_114/oj 114] Governing instrument: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act, Regulation (EU) 2024/1689], Chapter V on general AI models. 
Interest/Value it purports to protect: Article 1 (1) “to promote the uptake of human-centric and trustworthy artificial intelligence (AI)” to ensure the protection of health, safety, and fundamental rights.
One weakness in its accountability: [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng Article 43 (2)] "Conformity assessment" allows many high-risk systems to be checked by AI companies with no notified body.

Antropic's Fable 5.1 (Kate Davey)

2026-09-21T19:19:02Z

Davey Kate:

Kate Davey September 21, 2026 A Patchwork of Governance: Anthropic’s Fable 5.1 Word count: 491

 '''1. AI Model: Claude Fable 5.1: Anthropic board: non-state '''Source of authority: Anthropic creates its own authority as a Delaware-based corporation and through creating the infrastructure of Claude including its own safeguards.
Governing instrument: Anthropic governs itself with its own board and Responsibility Scaling Policy (RSP). Its latest risk report is from August 2026 and its most updated Responsible Scaling Policy is from July 8, 2026. It’s worth noting Anthropic references catastrophic risk/harm/damages 20 times in its report.Interest/Value it purports to protect: According to its own RSP it purports “Anticipating and securing against emerging threats that accompany increasingly powerful models.” In other words, preventing misuse and catastrophic risk. 
One weakness in its accountability: Anthropic governs itself. There is no external oversight board to say whether or not it is doing a good or even basic job.  '''2. SB-53 Artificial intelligence models: large developers: California State/Public''' Source of authority: Article IV of California Constitution, the “Artificial intelligence models: large developers” bill passed both houses and Governor Newsom signed it September 29, 2025. Governing instrument: California Constitution 
Interest/Value it purports to protect: The public from “catastrophic risk” as described from Chapter 138, Section 1, by requiring “a summary of any assessment of catastrophic risk, as defined, resulting from internal use of its frontier models, as specified.”
One weakness in its accountability: AI companies, including Anthropic, create their own framework against which they are evaluated. Section (1) 22757.12. (a).

 '''3. Executive Order 14409: Federal/Public''' Source of authority: Article II of the Constitution. It is worth noting there is no comprehensive federal law governing AI in the United States, just Executive Orders. Governing instrument: Executive Order 14409
Interest/Value it purports to protect: National security & cybersecurity “(a)  develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a “covered frontier model” for the purposes of this order, sharing such assessments with AI developers and researchers as appropriate.”
One weakness in its accountability: Benchmarks judging the models are classified and set by NSA director, and no court section 5(c) no rights enforceable in court – also it’s a “voluntary framework.”

 '''4. European Union: Regulation (EU) 2024/1689 of the European Parliament and of the Council'''Source of authority: AI Act / Treaty on the Functioning of the EU Articles 16 and 114 Governing instrument: AI Act, Regulation (EU) 2024/1689, Chapter V on general AI models. 
Interest/Value it purports to protect: Article 1 (1) “to promote the uptake of human centric and trustworthy artificial intelligence (AI)” to ensure the protection of health, safety, and fundamental rights.
One weakness in its accountability: AI companies check their own work. Article 43 (2) “providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.”

Governance by institutions

2026-09-21T19:18:31Z

Davey Kate:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

*[[social-media platform]] (mariona)
*****
= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.

Antropic's Fable 5.1 (Kate Davey)

2026-09-21T19:17:43Z

Davey Kate: Created page with "Kate Davey September 21, 2026 A Patchwork of Governance: Anthropic’s Fable 5.1 Word count: 491 '''1. AI Model: Claude Fable 5.1: Anthropic board: non-state '''Source of authority: Anthropic creates its own authority as a Delaware-based corporation and through creating the infrastructure of Claude including its own safeguards. Governing instrument: Anthropic governs itself with its own board and Responsibility Scaling Policy (RSP). It..."

Kate Davey September 21, 2026 A Patchwork of Governance: Anthropic’s Fable 5.1 Word count: 491

 '''1. AI Model: Claude Fable 5.1: Anthropic board: non-state '''Source of authority: Anthropic creates its own authority as a Delaware-based corporation and through creating the infrastructure of Claude including its own safeguards.

Governing instrument: Anthropic governs itself with its own board and Responsibility Scaling Policy (RSP). Its latest risk report is from August 2026 and its most updated Responsible Scaling Policy is from July 8, 2026. It’s worth noting Anthropic references catastrophic risk/harm/damages 20 times in its report.Interest/Value it purports to protect: According to its own RSP it purports “Anticipating and securing against emerging threats that accompany increasingly powerful models.” In other words, preventing misuse and catastrophic risk. 

One weakness in its accountability: Anthropic governs itself. There is no external oversight board to say whether or not it is doing a good or even basic job.  

'''2. SB-53 Artificial intelligence models: large developers: California State/Public''' Source of authority: Article IV of California Constitution, the “Artificial intelligence models: large developers” bill passed both houses and Governor Newsom signed it September 29, 2025. Governing instrument: California Constitution Interest/Value it purports to protect: The public from “catastrophic risk” as described from Chapter 138, Section 1, by requiring “a summary of any assessment of catastrophic risk, as defined, resulting from internal use of its frontier models, as specified.”One weakness in its accountability: AI companies, including Anthropic, create their own framework against which they are evaluated. Section (1) 22757.12. (a).

 '''3. Executive Order 14409: Federal/Public''' Source of authority: Article II of the Constitution. It is worth noting there is no comprehensive federal law governing AI in the United States, just Executive Orders. Governing instrument: Executive Order 14409Interest/Value it purports to protect: National security & cybersecurity “(a)  develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a “covered frontier model” for the purposes of this order, sharing such assessments with AI developers and researchers as appropriate.”One weakness in its accountability: Benchmarks judging the models are classified and set by NSA director, and no court section 5(c) no rights enforceable in court – also it’s a “voluntary framework.”

 4. European Union: Regulation (EU) 2024/1689 of the European Parliament and of the CouncilSource of authority: AI Act / Treaty on the Functioning of the EU Articles 16 and 114 Governing instrument: AI Act, Regulation (EU) 2024/1689, Chapter V on general AI models. Interest/Value it purports to protect: Article 1 (1) “to promote the uptake of human centric and trustworthy artificial intelligence (AI)” to ensure the protection of health, safety, and fundamental rights.One weakness in its accountability: AI companies check their own work. Article 43 (2) “providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.”

Governance by institutions

2026-09-21T19:08:36Z

Davey Kate:

*[[social-media platform]] (mariona)
****
= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.

Governance by institutions

2026-09-21T19:06:35Z

Davey Kate:

Antropic's Fable 5.1 (Kate Davey) 

*[[social-media platform]] (mariona)
***
= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.

Governance by institutions

2026-09-21T19:03:28Z

Davey Kate:

Antropic's Fable 5.1 (Kate Davey) 

*[[social-media platform]] (mariona)
**
= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.

Talk:Governance by history

2026-09-08T18:10:47Z

Davey Kate: Created page with "I completely agree with this sentence: "The AI space largely remains unregulated due to its undefined form and fluid nature, however, this has given way for unethical and morality issues regarding data privacy, exploitation of labour and environmental harms." I also think that this is where the question of who is deciding what truth is comes in because Big Tech isn't giving the names of who is making the final decision on how "truth" is decided and in addition, we don't..."

I completely agree with this sentence: "The AI space largely remains unregulated due to its undefined form and fluid nature, however, this has given way for unethical and morality issues regarding data privacy, exploitation of labour and environmental harms." I also think that this is where the question of who is deciding what truth is comes in because Big Tech isn't giving the names of who is making the final decision on how "truth" is decided and in addition, we don't know how they are using user data because it is evolving so quickly. 