Websites · Glossary
What is a data export request?
A data export request is a person asking a business for a copy of the personal information it holds about them, often in a downloadable file. Under the GDPR and UK GDPR it is a subject access request, answered within one month, and may include a portability request for a machine readable copy. In Australia it is an access request under Australian Privacy Principle 12.
An export request is the right of access put into practice. The deadline, the format and what counts as the person's own data differ by country, but the starting point is the same: find everything, check it is theirs, and send it.
Indunil Asanka · Co-founder
6 min read · Published
| Question | GDPR (EU) | UK GDPR | Australian Privacy Act |
|---|---|---|---|
| Name | Subject access request | Subject access request | Access request under APP 12 |
| Deadline | One month, extendable by two | One month, extendable by two | Reasonable period, generally 30 days |
| Fee | Free, except manifestly unfounded or excessive requests | Free, except manifestly unfounded or excessive requests | No fee to ask; reasonable fee for access |
| Portability right | Yes, machine readable copy | Yes, machine readable copy | No general right; sector schemes only |
| Who is covered | Businesses handling EU residents' data | Businesses handling UK residents' data | Mostly turnover over $3 million, plus some others |
| Regulator | National data protection authorities | ICO | OAIC |
What a data export request is
People have a legal right in many countries to see what a business knows about them. A data export request is that right exercised: "please send me a copy of all the personal data you hold about me". In the EU and UK it is called a subject access request, and the response must include the data itself plus information about why it is processed, who it is shared with, how long it is kept and where it came from. A related right, data portability, lets a person ask for data they provided, in a structured, commonly used, machine readable format such as CSV or JSON, so they can take it to another service. In Australia, businesses covered by the Privacy Act must give people access to their personal information on request under Australian Privacy Principle 12, subject to listed exceptions, though there is no general portability right outside specific schemes such as banking and energy data.
How to answer one
Start by confirming who is asking. Sending someone's bookings, messages and address to an impostor is a breach, so check identity in proportion to the data: a request from the signed in account is usually enough, while an email from an unknown address may need more. Then search every place personal data lives: the website's database, the email inbox, the booking tool, the payment provider, spreadsheets and backups. Collect the person's own records: their profile, orders, bookings, form submissions, messages they sent and notes about them. Leave out other people's personal information, such as the other side of a conversation, unless it can be shared. Package it in a form people can open, commonly CSV files per type of record and one JSON file of everything, with a short cover note explaining each file. Keep a record of the request, the date it arrived, what was sent and when, in case the person or a regulator asks later.
When the rules apply
Under the GDPR and UK GDPR, any business handling personal data of people in those places must answer within one month, extendable by two further months for complex or numerous requests, and normally cannot charge a fee. In Australia, APP 12 covers organisations under the Privacy Act, which includes businesses with annual turnover over $3 million and some smaller ones such as health service providers and businesses that trade in personal information. Organisations must respond within a reasonable period, which the regulator's guidelines treat as generally within 30 days, may not charge for making a request, and may charge only a reasonable fee for giving access. Even where a small business is not legally covered, answering promptly is cheap goodwill and makes it easier if the law or the business's size changes. A site that lets signed in customers download their own data turns most requests into a button press.
Common mistakes
Ignoring a request because it arrived by social media message or was not labelled with the legal term; a request does not need special words. Missing the deadline because nobody owned the inbox it arrived in. Sending data to an unverified email address. Including other customers' names from shared threads or staff notes that identify colleagues. Sending a screenshot or a PDF when the person asked for a portable copy. Forgetting data held by tools the business uses, such as a payment provider or email newsletter service. Charging a fee where the law does not allow one. Treating an export request as a deletion request, or the reverse; they are separate rights and the person should get exactly what they asked for. And building a website that stores customer data with no way to find all of one person's rows, which turns every request into a manual search.
Where it shows up in OneCraft
When a site with a database is generated with the legal capability, the AI follows its legal guide. A signed in person gets a privacy page in their account with Download my data and Delete my account. The download is built by a database function that returns only the person's own rows, never other people's, so not the other side of a conversation, as one CSV file per table plus one JSON file of everything. Deleting asks the person to type DELETE, removes their rows, keeps paid orders and invoices with the customer's name and email replaced, and records the request; their sign in account itself stays. A public data request form lets people without an account ask for an export, deletion or correction, and admins work through open requests and mark them done. The AI writes no privacy policy: the owner supplies that text.
Questions people ask
Do I have to check someone's identity before sending their data?
Yes, in proportion to the risk. Sending personal data to the wrong person is itself a privacy breach. A request made while signed in to the person's own account is usually strong evidence. For an email from an unfamiliar address, ask for something only the real person would know, rather than a copy of a passport you then have to protect.
Can a business refuse a data export request?
Sometimes, on narrow grounds. Under the GDPR a request can be refused or charged for if it is manifestly unfounded or excessive, and Australian law lists exceptions such as where access would unreasonably affect someone else's privacy. Refusals must be explained in writing with how to complain. Most requests from customers should simply be answered.
What file format should a data export be in?
Something the person can open and reuse. CSV files open in any spreadsheet and suit tables such as orders or bookings; a JSON file keeps the structure for moving to another service. Add a short note explaining what each file contains. A PDF printout satisfies a basic access request but not a portability request.
Is a deletion request the same as an export request?
No. Export gives the person a copy and changes nothing. Deletion, the right to erasure in the GDPR, removes their data, subject to records the business must keep by law, such as tax invoices. People often ask for both, export first. Handle each as the person asked and confirm in writing what was done.
Does an export need to include emails about the person?
Under the GDPR and UK GDPR, emails that contain the person's personal data are generally within scope, including internal emails about them, though other people's information in those emails may need to be removed first. Search the business inbox along with the website's database, and keep a note of what you searched.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is a consent banner?What is a consent banner? The notice that asks before non essential cookies and embedded videos or maps load. What the UK, EU and Australia expect of it.
- What is a Supabase project?What is a Supabase project? One Postgres database with sign in, file storage and an API on top. What a project includes, what it costs, and how keys work.
- What is row level security?What is row level security? Database policies that decide which rows each signed in person can read or change, with common policy shapes and how to test them.
- What is a hiring pipeline?What is a hiring pipeline? The stages an applicant moves through, from new to screening, interview, offer and hired or rejected, and what happens at each.
Written and checked by the OneCraft team. Last checked .