Build1 distinct publisher2 min readPublished
Article 20 reaches what you typed and what the service logged. The vectors, the profile and the generated report sit in the category the guidance excludes, which makes leaving an AI vendor a contract job.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
Work out what actually lands in the archive. Prompt text and account fields, because you typed those. Usage logs as well, since the guidance treats observed data as provided by virtue of using the service [5]. That is two of the three categories in the taxonomy, and the one you lose is the one that took the compute [7]. On the dev.to author's reading, the excluded bucket is where an AI service keeps the vectors that index your documents, the behavioural profile that decides what you see, and arguably the reports and pictures the model made for you, all of them products of the provider's analysis rather than things you handed over [8]. Inputs are on firm ground, the artefacts built out of them much less so [16].
A right that is discharged by returning a zip of your own typing is a right a vendor can satisfy without touching an interesting table.
For Article 20 to reach further, someone would have to accept that model output is provided data. That is not an oversight waiting to be patched. The line was drawn on purpose, to stop portability being used to extract a company's analytical work [9], and it was drawn in 2016 with recommendation engines and social feeds in view [10]. The reasoning holds for the systems it was written about. It transfers to a generative service only if you also accept that a finished report is the provider's analysis rather than your deliverable [10]. Note too that the direct-transfer-to-a-competitor limb is qualified by technical feasibility, and the vendor is the party in a position to assess that [3].
So exit reads as a procurement exercise. The clauses that decide whether you can leave are the dull ones: a named export format for generated artefacts, a copy or a deletion attestation for the embeddings derived from your corpus, and an explicit position on who holds the copyright in the outputs, since the statute only gestures at ownership [12]. None of that arrives from a data subject request. All of it is cheap to ask for before signature and expensive to ask for mid-migration.
The excerpt says Article 20 is not the only instrument and that newer ones widen the picture, though it breaks off before naming them [14]. Until one of those speaks to derived data, the planning assumption I would defend at review is that switching cost belongs in the procurement model rather than the compliance register, which returns the one thing you already hold a copy of [15].
Ranked by verification strength, evidence, and original report placement.
GDPR Article 20, the right to data portability, gives a person the right to receive personal data concerning them that they provided to a controller in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance.
Article 20 applies only where two conditions hold: the processing is based on the person's consent or on a contract, and it is carried out by automated means.
For a consumer AI service a person signed up to and uses, those conditions generally apply, so the person can ask for their data in a portable form and, where technically feasible, have it sent straight to a competitor.
The Article 29 Working Party guidelines that still frame how Article 20 is read split personal data into three kinds: data actively given, data observed during use of the service, and data inferred or derived by the provider.
Data actively given, such as an email address or the text of a prompt, is provided and portable; observed data such as usage logs, search history or location is also treated as provided by virtue of the use of the service and is portable too.
The third category, inferred or derived data meaning conclusions the provider generates by analysing the person, is explicitly excluded from the portability right.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 30, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
An atomic claim on one flow record makes a duplicate OAuth callback harmless1 distinct publisher
build
Portable Or Native: The Endpoint Choice Is A Runbook Decision, Not An SDK Preference1 distinct publisher
build
Four field types encrypted, one left readable: the decision that prices per-user envelope encryption1 distinct publisher
build
"The model does not retain training data" is a testable claim, and someone else runs the test1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Quotable law, one interpreter
Two things here can be checked against primary text: Article 20's operative wording, quoted rather than paraphrased, and the regulators' three-way split of given, observed and inferred data. dev.to reproduces both without visible strain. The move everything else rests on — sorting embeddings, behavioural profiles and model outputs into the excluded bucket — arrives with no regulator statement, complaint outcome or vendor position behind it, and dev.to hedges it to "arguably" in the same breath. Verifiable premises, untested conclusion.
No usage signal at all
Nothing in this reporting counts as observed behaviour. dev.to asserts that the export button often isn't there, but names no service, cites no portability request that was filed, and reports no regulator or vendor response. We decline to score take-up from an assertion.
Firmer than the untested part deserves
The framing is deflationary by design — it exists to talk you down from thinking the law hands you your chat history — so it mostly avoids overreach. The small excess is the confidence with which the vectors and generated outputs land on the excluded side of a line no regulator has yet drawn there for generative AI. Slightly ahead of its evidence, nowhere near hype.
House angle, no commercial stake
This runs under a standing "The AI Downside" byline on dev.to, which is an editorial thesis looking for confirming material — a story about a right that half-works fits the brand neatly. There is no vendor, law firm, or product on the other end of the argument, and no paid tool is being steered toward, so the pull is toward a conclusion rather than toward a sale.
Sound on the statute, thin everywhere else
We are comfortable telling you what Article 20 says and what the guidance excludes. We are considerably less comfortable telling you that a regulator would classify your vendor's embeddings as derived data, because nothing in this reporting establishes it — and the copy we hold stops mid-sentence just as it turns to what a compliant data dump actually looks like.