Hand one customer their file

Before you tell a customer you can hand them their data, three things have to be true when you are alone. You can find that person's rows without asking the person who built the product. You can put those rows in a file the customer can open. The file does not contain the next customer's rows, and you checked one of those rows by name before you sent it. If any of the three needs a call, you do not have an export. You have a promise that the vendor might keep. Leave the sentence off the reply.

This is the afternoon a living customer asks for a copy. It is not the afternoon you delete them, and it is not the afternoon you load yesterday onto a system that is not production. Deletion ends what the product can still show. A restore proves a backup loads. Closing public signup, and erasing the one account you just created, proves you can end a user you made. None of those produces a file this customer can read. All three can be finished while the only way to extract one person is a script on someone else's laptop. The rest of this article is the three proofs, in the order a founder can perform them without a call.

None of what follows decides whether a statute covers your business, and none of it is legal advice. The texts below are the clearest public statements of what a copy is, whom it may not include, and how long a reply may take. They do not tell you which law binds a Virginia company with a customer in another country. They do not replace the lawyer you call when the request is a letter from counsel. They do tell you the shape of a file you can defend, which is a product question you can answer this week.

A copy is not a feeling that you could produce one. Article 15 of Regulation (EU) 2016/679 gives the data subject "the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data" and a listed set of information: purposes, categories, recipients, storage period or the criteria for it, the existence of other rights, the right to complain, the source where the data were not collected from the person, and, where automated decision-making including profiling is in use, "meaningful information about the logic involved, as well as the significance and the envisaged consequences" (European Union, Regulation (EU) 2016/679, Article 15(1)). Paragraph 3 is the object: "The controller shall provide a copy of the personal data undergoing processing." A further copy may carry "a reasonable fee based on administrative costs." An electronic request is answered "in a commonly used electronic form" unless the person asks otherwise. Read the two paragraphs as two different deliveries. Confirmation that you hold something is a sentence. The copy is a file. A support reply that says "we have your data" has done the first and skipped the second.

The file stops where the next person starts. Article 15(4) is one sentence, and it is the sentence a multi-tenant product fails: "The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others." A CSV of the whole table, because that was the easiest query, is not a copy of one person. It is a copy of everyone the query happened to return, and the rights it adversely affects are sitting in the rows you did not mean to include. The same limit is repeated for portability. Article 20(4) says the portability right "shall not adversely affect the rights and freedoms of others." Two articles, one test. Open the file and search for a name, an email, or an invoice that belongs to someone else. If you find one, you do not have an export. You have a leak with the customer's address on it.

Portability is a narrower file than access, and founders mix them. Article 20(1) is the right "to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format" and to transmit it to another controller, where the processing "is based on consent" or "on a contract" and "is carried out by automated means." The words "which he or she has provided" are the limit. Data the person typed, uploaded, or submitted is in. Inferences you computed, scores you assigned, and notes your staff wrote are not, on this article, part of the portable set. Article 20(3) says the exercise of that right "shall be without prejudice to Article 17," which is erasure. Sending the file does not delete the account. Deleting the account does not satisfy a person who asked for the file. Article 15's copy is the wider object: the personal data undergoing processing, plus the list in paragraph 1. A JSON file of what they typed is a portability candidate. It is not, by itself, the access copy, if you also hold a record they never typed. Name which request you received before you choose the file.

The clock is one month, and the extension is a notice, not a silence. Article 12(3) requires the controller to "provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request." The period "may be extended by two further months where necessary, taking into account the complexity and number of the requests," and the person must be told of the extension "within one month of receipt of the request, together with the reasons for the delay." Article 12(5) says the communication is free of charge, unless the request is "manifestly unfounded or excessive," in which case the controller may charge a reasonable fee or refuse, and "shall bear the burden of demonstrating" that character. Article 12(6) allows you to ask for more information where you have "reasonable doubts concerning the identity" of the person. One month is the regulation's period. It is not a suggestion that a startup may answer when the vendor is back from holiday. An extension you did not send inside the first month is not an extension. It is a late reply. Identity is a check you do before the file, not a reason to send the file to whoever mailed you.

You are not a European public authority, and this regulation may not be the one that binds the request in your inbox. The translation that still holds, as a product test, is short. A copy is a file of that person. The file excludes other people. The portable subset is what they provided, in a format a machine can read, and only where the basis is consent or a contract and the processing is automated. The reply has a date. A dashboard screenshot you text them is none of those.

The complaints that reach a regulator are mostly about this right, and they are not your users. The UK Information Commissioner's Office received 42,315 data protection complaints in 2024/25, compared with 39,721 in 2023/24. In the same report, "Article 15 complaints (about the right of access) account for most of our data protection complaints work." Of the 36,196 data protection cases finished in 2024/25, 67% led to advice and 33% led to informal action. Those two add to 100, so read them as one question's two answers about finished cases, not as two studies, and not as the share that were Article 15. The report says Article 15 accounts for most of the work. It does not print that share as a percentage, and this article will not invent one. The 42,315 are complaints the office received. They are not a count of requests companies fulfilled, not a count of startups, and not a probability that your next customer writes this week. The office regulates information rights. It does not sell you an export feature (Information Commissioner's Office, Annual Report and Financial Statements 2024-25). What you take from it is the practice the volume keeps failing: a person asked for access, and the organisation could not show a copy.

You can find that person's rows. Sit down without a call. Name the table, the bucket, or the account where this customer's data lives, and the field you would filter on — an email, an internal id, a tenant. Open it with a login that is yours. If the only filter is a query the contractor runs, you have not found the rows. You have found their query. A handover that lists the cloud account, the registrar, and an export you have run once, of everything, is the handover. Tonight's proof is smaller. A full dump is not one person. A login you cannot use does not become one person because the dump exists. The questionnaire that asks whether you can export, as a product fact rather than a company badge, is your first security questionnaire. The answer it wants is the file, not the word yes.

You put it in a file they can open. Write the rows out as CSV, JSON, or another form you would be willing to open in a spreadsheet yourself. Article 15's electronic form and Article 20's machine-readable format are the same kind of demand: not a PDF of a screen, and not a paragraph in an email that summarises what you remember. Include the fields you actually hold for them. If the request is access, the copy is the personal data undergoing processing, and the paragraph-1 list is information about the processing, which can be a second page. If the request is portability, stop at what they provided, and say so in the note, so you are not pretending a score you computed was something they typed. Time the export, even roughly. A procedure that only finishes when someone else is awake has not met a one-month clock you might be under. It has met their calendar.

A row that is not theirs is the fail. Before you send, pick one identifier that must not appear: the other test user's email, the neighbouring tenant's invoice number, a staff note about a different account. Search the file. Present means fail. An empty search on a file that also does not contain the requester is a different fail — you filtered too hard, or you filtered the wrong person. Counts do not save you. A file with the right number of rows can still be the wrong person, and a file with one extra email is the Article 15(4) case whether or not you meant it. The cousin of this check, for an account you created and now want gone, is what to prove before public signup. Erasing the test user does not produce a copy. Loading yesterday's database onto a scratch system, which is restore yesterday without the vendor, does not produce one either. Do not borrow either afternoon to avoid this one.

There is a version of this request where hiring more engineering is the wrong purchase. Nothing has been built, so there are no rows to find and no file to open. You are still choosing between two firms, and neither has a database you administer. No customer has asked, and the product holds no personal data, because it is a brochure. A customer has already seen another customer's data. That is an incident, and the first hour is not an export drill — sending a file during that hour is how the incident grows. Do not treat the word "export" in a proposal as the proof. The proof is the file, checked against a name that must not be in it.

What the three proofs look like when a product actually holds records is ordinary and visible. Gigbase, a multi-tenant workspace, had to keep projects, contracts, and invoices in one product, with subscription plans and roles, and more than one organization in the same system. A founder running this afternoon's test can name one organization, write out that organization's rows, and search the file for an invoice that belongs to another. Nothing in that description is a headcount, a duration, or a result figure. The shape is the point: if customers have rows, those rows are separable, or the product cannot hand one person their file without handing them someone else's.

On the afternoon you are tempted to reply "we can export your data," do the three proofs before you send the sentence. Find the rows in an account you administer. Write the file in a form you can open. Search it for the one identifier that must be absent, and for one that must be present. Then the sentence is allowed. A startup software development company that expects this will have put the filter, the file, and a login you control in place before the first real request, because the proofs take them nothing they were not already operating. One that needs a call in order for you to extract one customer is telling you who holds the record. If the first slice is a fixed capability rather than an open-ended platform, an AI integration sprint is the shape where the acceptance sentence can include these three proofs before anyone calls the button an export. The criteria for choosing who holds that login sit on the page written for a top saas development company. That page is criteria, and it does not rank anyone, including us.