GDPR's portability right stops at the embeddings your vendor built from your prompts

Work out what actually lands in the archive. Prompt text and account fields, because you typed those. Usage logs as well, since the guidance treats observed data as provided by virtue of using the service ^[5]. That is two of the three categories in the taxonomy, and the one you lose is the one that took the compute ^[14]. On the dev.to author's reading, the excluded bucket is where an AI service keeps the vectors that index your documents, the behavioural profile that decides what you see, and arguably the reports and pictures the model made for you, all of them products of the provider's analysis rather than things you handed over ^[15]. Inputs are on firm ground, the artefacts built out of them much less so ^[16].

A right that is discharged by returning a zip of your own typing is a right a vendor can satisfy without touching an interesting table.

For Article 20 to reach further, someone would have to accept that model output is provided data. That is not an oversight waiting to be patched. The line was drawn on purpose, to stop portability being used to extract a company's analytical work ^[7], and it was drawn in 2016 with recommendation engines and social feeds in view ^[8]. The reasoning holds for the systems it was written about. It transfers to a generative service only if you also accept that a finished report is the provider's analysis rather than your deliverable ^[8]. Note too that the direct-transfer-to-a-competitor limb is qualified by technical feasibility, and the vendor is the party in a position to assess that ^[3].

So exit reads as a procurement exercise. The clauses that decide whether you can leave are the dull ones: a named export format for generated artefacts, a copy or a deletion attestation for the embeddings derived from your corpus, and an explicit position on who holds the copyright in the outputs, since the statute only gestures at ownership ^[10]. None of that arrives from a data subject request. All of it is cheap to ask for before signature and expensive to ask for mid-migration.

The excerpt says Article 20 is not the only instrument and that newer ones widen the picture, though it breaks off before naming them ^[12]. Until one of those speaks to derived data, the planning assumption I would defend at review is that switching cost belongs in the procurement model rather than the compliance register, which returns the one thing you already hold a copy of ^[13].