Data portability is meant to make switching providers easier: people who can take their data with them are less tied to a service. For SaaS providers the right is therefore not just a legal question but a product requirement.
Conditions
Under Art. 28 FADP anyone can ask the controller to hand over, in a common electronic format, the personal data they provided, if the controller processes the data automatically and does so with their consent or in direct connection with a contract. They can also request direct transfer to another controller, provided this does not require disproportionate effort. Art. 20 GDPR is comparable.
Which data is covered
Data the person provided themselves, such as profile details, uploaded content or usage data generated through use. Results of the controller’s own analysis, such as ratings or derived profiles, are generally not covered. The line is not always clear in individual cases.
Format and fees
A structured, common and machine-readable format such as CSV or JSON is required, not a PDF printout. Under Swiss law handover is generally free; the rules on contributions match those for the right of access.
Practice for SaaS providers
Offering an export function in the product fulfils the right with little effort and anticipates one of the most common customer questions: what happens to my data when I cancel? A complete export in open formats is therefore a basic requirement for a SaaS application, as is a deletion concept for the period after the contract ends.