Data:India
Words: 1911
Data Portability Rights
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).
India's Digital Personal Data Protection Act
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish de facto portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).
India's Digital Competition Bill
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).
Comparison with the European Union Data Portability Regime
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).
What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.
References
(4) Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization; and Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.
(5) Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026; Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026; DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026; Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026; “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026; and Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026.
(6) Digital Personal Data Protection Act 2023 (India), No. 22 of 2023; and Vrabec, Bansal and Gupta (n 4).
(7) Vrabec, Bansal and Gupta (n 4).
(8) DPDP Act 2023 (n 6).
(9) Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026; and Vrabec, Bansal and Gupta (n 4).
(10) Vrabec, Bansal and Gupta (n 4).
(11) Khandelwal (n 9).
(12) Khandelwal (n 9).
(13) Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009; and Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.
(14) OECD, “The Impact of Data Portability” (n 2).
(15) Khandelwal (n 9).
(16) OECD, “The Impact of Data Portability” (n 2).
(17) Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026; and Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026.
(18) Khandelwal (n 9); Hooda (n 17).
(20) Shukla (n 17).
(21) Khandelwal (n 9).
(24) GDPR (n 23).
(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.
(26) Lazarotto (n 22).
(27) DPDP Act 2023 (n 6).
(29) Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021 (3) Proceedings on Privacy Enhancing Technologies 351.]
(30) Lazarotto (n 22).
(31) Data Act (n 25), art 50.
(32) Khandelwal (n 9).
(33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.
(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) google.com/url?q=https://www.lkslaw.com/insights/articles/dpdp-act-and-rules-a-ticking-compliance-timeline&sa=D&source=docs&ust=1791533165444212&usg=AOvVaw0UnGsQPiEAPPEtcWmOYxaR accessed 4 October 2026.
(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).
(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).
(37) DPDP Act 2023 (n 6), s 2(g).