Data:India

Data Portability Right

Data portability rights entitle individuals to legally transfer their data from one data holder to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder’s (2).

Data portability rights would not only bolster individuals’ control over their data but also market interoperability, innovation, and competition among data holders (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders market.

Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (or is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

Digital Personal Data Protection Act

The Digital Personal Data Protection Act (DPDPA) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder to another (“data fiduciaries” and “data processors” in the law’s terminology).

The DPDPA bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (Section 26 of the 2018 bill draft, and Section 19 of the 2019 bill draft) (9). However, the DPDPA final version did not recognize the right for reasons not yet revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple platforms), and because it could present technical obstacles for the transferring of a single unit of data related to various individuals (i.e. a photograph relative to different individuals who differ on how it should be transferred across multiple platforms) (10); according to others, India might be constructing a sector based regulatory structure in which individuals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).

In this sense, even though the DPDPA does not recognize a data portability right, some special legal regimes establish de facto portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles individuals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (the obligation is reaffirmed in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).

The absence of a data portability right affects individuals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data holder to another and to decide who processes their data. In this sense, data portability rights vest individuals with the power to switch data holders based on their own preferences (i.e. the data holder technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data holder discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).

Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between individuals and data holders, and, to improve transparency for the benefit of the former (16).

Digital Competition Bill

Beyond the DPDPA, the Digital Competition Bill (DCB) establishes obligations related to the data portability right. The DCB - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on the “Anti-Competitive Practices by Big Tech Companies” (17). The DCB, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).

Considering the above, the DCB establishes the obligation of dominant technology companies to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for enterprises and individuals in the transfer of their data to competing technology companies (20).

It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data holders while in a competition regime is of particular application to dominant technological companies. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

Comparison with the European Union Data Portability Regime

The three most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.

Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.

The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal. As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (25). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.

India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (26). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.

But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (27).

In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (28). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often. The Data Act has only been applicable since September 2025, so it is even harder to say how effective it has been.

While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (29). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (30). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.

How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (31). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (32).

India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (33). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (34).

What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

References

(1) Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.

(2) OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf accessed 2 October 2026.

1. Paul De Hert and Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193 (https://www.sciencedirect.com/science/article/pii/S0267364917303333).
2. Youping Li and Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization (https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X); and Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context accessed 2 October 2026.
3. Daniela Bresic and Teodora Lalova-Spinks, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ accessed 2 October 2026; Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right accessed 2 October 2026; DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) https://www.dlapiperdataprotection.com/?t=transfer&c=BR accessed 2 October 2026; Delara Derakhshani, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) https://dtinit.org/blog/2025/07/29/data-portability-regulatory accessed 2 October 2026; “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability accessed 2 October 2026; and Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights accessed 2 October 2026.
4. Digital Personal Data Protection Act 2023 (India), No. 22 of 2023 (https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf); and Vrabec, Bansal and Gupta (n [4]).
5. Vrabec, Bansal and Gupta (n [4]).
6. DPDP Act 2023 (n [6]).
7. Pankhudi Khandelwal, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ accessed 2 October 2026; and Vrabec, Bansal and Gupta (n [4]).
8. Vrabec, Bansal and Gupta (n [4]).
9. Khandelwal (n [9]).
10. Khandelwal (n [9]).
11. Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009 (https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf); and Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf accessed 2 October 2026.
12. OECD, “The Impact of Data Portability” (n [2]).
13. Khandelwal (n [9]).
14. OECD, “The Impact of Data Portability” (n [2]).
15. Ashutosh Shukla, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) https://www.irccl.in/post/data-portability-and-the-digital-competition-bill accessed 2 October 2026; and Tanisha Hooda, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ accessed 2 October 2026
16. Khandelwal (n [9]); Hooda (n 17]).
17. Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf accessed 4 October 2026.
18. Shukla (n [17]).
19. Khandelwal (n [9]).
20. Barbara Lazarotto, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology https://ejlt.org/index.php/ejlt/article/view/988 accessed 2 October 2026.
21. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (https://gdpr-info.eu/).
22. GDPR (n [23]).
23. Lazarotto (n [22]).
24. DPDP Act 2023 (n [6]).
25. Janis Wong and Tristan Henderson, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, https://doi.org/10.1093/idpl/ipz008 accessed 4 October 2026. 
26. Emmanuel Syrmoudis and Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351 (https://petsymposium.org/popets/2021/popets-2021-0051.php).
27. Khandelwal (n [9]).
28. Khandelwal (n [9]).
29. Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.
30. DCB 2024 (n [19]).
31. Khandelwal (n [9]).
32. DPDP Act 2023 (n [6])