UAE and Saudi Arabia: What Data Portability Laws Allow

Imagine switching from one fitness application to another and taking years of workout records with you. A customer in Dubai wants to move photographs from one cloud service to another, while a professional in Riyadh hopes to transfer account information between digital platforms without starting from the beginning. These situations raise an important question: should consumers have to leave their information behind whenever they change service providers?

As digital platforms become central to everyday life, personal data portability is emerging as an important part of consumer privacy, competition and digital innovation.

People generate information whenever they use banking applications, social networks, online stores, healthcare platforms and subscription services. Some information is provided directly, while other records are generated through transactions and interactions.

This creates a practical challenge when someone wants to change providers.

A user may be able to close an account but struggle to transfer contacts, purchase records, photographs or personal preferences to another service. In some cases, the information can be downloaded but cannot easily be imported elsewhere.

Data portability aims to reduce these obstacles by giving eligible individuals ways to receive and reuse information associated with them.

The concept is already recognised in important legal frameworks.

In the United Arab Emirates, Article 14 of Federal Decree-Law No. 45 of 2021 establishes a qualified right to receive certain personal data in an organised, machine-readable form and request its transfer to another controller where technically feasible.

Saudi Arabia’s Personal Data Protection Law also provides a right to request personal information in a readable and clear format. Its implementing regulations specify that applicable information should be provided in a commonly used electronic format.

Beyond general privacy legislation, the UAE is developing a regulated Open Finance Framework that enables approved financial service providers to share certain customer information with appropriate authorisation.

Major technology companies already offer practical examples. Google Takeout allows users to export data from supported services, while certain direct-transfer tools can copy eligible information to other providers.

However, downloading information is not the same as moving an entire digital experience.

The receiving platform must still support the data format, and legal restrictions may limit what can be transferred.

The future of portability therefore depends on three interconnected factors: meaningful consumer rights, compatible technology and secure information-sharing systems.

What Is Personal Data Portability?

Personal data portability is the ability to obtain certain information relating to an individual and reuse it with another service or organisation.

It can involve downloading a copy of personal information or requesting a transfer between service providers, subject to applicable legal and technical conditions.

The concept is closely associated with consumer control over information.

However, portability should not be confused with unrestricted ownership of every record held by a company.

What Information Can Be Portable?

Potentially portable information includes account details, contacts, transaction histories, photographs, calendars and other records.

The actual categories depend on applicable law and the capabilities of the services involved.

Some information may contain data relating to other people, which creates additional privacy considerations.

Data Access vs Data Portability

The right to access personal data generally allows individuals to obtain information about data held by an organisation.

Portability goes further by focusing on receiving information in a reusable form or transferring it to another provider.

A PDF report may be useful for reading, but it may not be suitable for importing into another application’s database.

Structured files such as CSV or JSON can sometimes make information easier for software to process.

Exporting Data Does Not Mean Deleting It

When someone transfers photographs or account records, the original provider may retain its copy.

Google’s official transfer guidance explicitly explains that moving a copy of data does not automatically delete it from Google’s services.

Deletion is a separate process, governed by platform settings, applicable laws and legitimate retention requirements.

Understanding Different Data Rights

These rights may overlap, but they are not interchangeable.

7 Benefits of Personal Data Portability for Consumers

Data portability can make digital services more convenient and reduce the difficulties associated with changing providers.

However, the practical benefits depend on what information is available and whether another service can use it.

1. Easier Switching Between Platforms

Consumers may want to change providers because of pricing, functionality, privacy practices or service quality.

Being able to transfer relevant information can reduce the inconvenience of starting again.

A person changing email providers, for example, may want to preserve contacts and historical messages.

2. Greater Control Over Personal Information

Portability can help individuals understand which information a platform holds and how it may be reused.

Receiving an export also allows users to maintain copies of important records.

However, obtaining information does not automatically give consumers unrestricted control over every subsequent use by another provider.

3. Reduced Dependence on One Company

Some digital services become difficult to leave because users have accumulated extensive records or personalised settings.

This is often called platform lock-in.

Portability can reduce switching barriers, potentially encouraging companies to compete through service quality rather than making it difficult to leave.

4. Better Access to Financial Services

Approved financial data-sharing arrangements may allow consumers to use their information across participating services.

In the UAE, Open Finance provides a regulated framework for certain customer-authorised data-sharing activities.

However, these arrangements are not equivalent to transferring every bank record to any application.

5. More Convenient Digital Record Management

People may use several cloud services, productivity applications or digital storage platforms.

Portability can help them consolidate relevant files and maintain backups.

Users should still check whether the export includes metadata, formatting and other information they need.

6. New Opportunities for Personalised Services

With appropriate permission, a new provider may be able to use imported information to offer a more relevant experience.

For example, a financial management application might organise authorised transaction records into spending categories.

However, personalisation must respect applicable privacy and security requirements.

7. Stronger Consumer Choice

Portability can make it easier for people to compare alternatives without sacrificing years of information.

This may support competition and innovation where technically compatible services exist.

However, effective competition also depends on pricing, service quality and market access.

Seven Benefits Compared

The strongest form of portability allows information to remain useful after it leaves the original platform.

UAE and Saudi Arabia: What Data Portability Laws Allow

The UAE and Saudi Arabia have established personal data protection frameworks, but they do not provide identical portability rights.

Understanding the distinction is essential when considering whether residents can legally demand that companies transfer information to another platform.

The UAE’s Personal Data Protection Law

Federal Decree-Law No. 45 of 2021 came into force on January 2, 2022.

Article 14 establishes a right to receive certain personal data that an individual has provided to a controller.

The provision applies when processing is automated and based on the individual’s consent or necessary for fulfilling a contractual obligation.

It also recognises the right to request a transfer to another controller where technically feasible.

However, this is a qualified right rather than a guarantee that every record held by every company can be transferred.

The federal law also contains exclusions involving government data, certain regulated health and banking information, and entities subject to separate data protection frameworks.

Saudi Arabia’s Personal Data Protection Law

Saudi Arabia’s Personal Data Protection Law provides individuals with several rights concerning their information.

Article 4 includes the right to request personal data in a readable and clear format.

The implementing regulations further explain that an eligible copy should be provided in a commonly used electronic format.

This is an important consumer right, but it should not be described as identical to the UAE’s explicit controller-to-controller transfer provision.

The Saudi regulations generally require controllers to address applicable individual rights requests within 30 days, with a possible additional 30-day extension under specified circumstances.

DIFC and ADGM

The Dubai International Financial Centre and Abu Dhabi Global Market operate separate data protection frameworks.

Organisations within these jurisdictions may have different obligations from businesses governed by the general UAE federal law.

Consumers and businesses should establish which framework applies before making legal assumptions.

UAE vs Saudi Arabia

What About the Rest of the GCC?

Bahrain has a Personal Data Protection Law established under Law No. 30 of 2018.

It regulates personal data processing, individual rights and international transfers.

Qatar, Oman and other GCC jurisdictions also maintain relevant data protection arrangements.

However, the existence of privacy legislation does not automatically establish an identical portability right in every GCC country.

Businesses operating regionally must assess each jurisdiction separately.

How Google, Apple and Digital Platforms Enable Data Transfers

Data portability is already available in certain forms through established technology platforms.

These tools demonstrate what is possible, but their capabilities vary considerably.

A service may allow information to be downloaded without supporting a complete transfer into another provider.

Google Takeout

Google Takeout allows users to export information from supported Google services.

Depending on the account and product, exports may include photographs, documents, calendars, emails and other records.

Google provides different file formats, including common formats intended to make information reusable.

For example, contacts may be exported in vCard format, which is supported by many address-book applications.

Moving Photographs Between Services

Google also provides supported methods for transferring copies of photographs and videos to other services.

Its documentation explains that users can select eligible files and authorise a transfer to a supported destination.

However, unsupported file types, storage limitations and differences in how providers manage albums can affect the outcome.

The original photographs are not automatically deleted when a copy is transferred.

Apple’s Data and Privacy Controls

Apple offers data access and transfer features through its privacy services.

Certain categories of information may be available for download or transfer, depending on the user’s region, account and supported destinations.

However, consumers should not assume that all Apple information can be directly transferred into every competing application.

Data Transfer Project

The Data Transfer Project is an industry initiative focused on technologies that can support direct movement of information between digital services.

Its work demonstrates how common standards and interoperable tools can reduce the need for manual exports.

However, participation in industry initiatives does not guarantee full interoperability between every platform.

Platform Transfer Methods Compared

Why Downloadable Data May Still Be Difficult to Use

A downloaded archive may contain information that the new platform cannot recognise.

For example, a user might receive photographs with associated metadata in separate files.

The new provider may import the images but fail to preserve their organisation, labels or relationships.

True portability therefore requires cooperation between exporting and receiving services.

Open Finance and New Data-Sharing Opportunities in the Gulf

Financial services provide one of the clearest examples of how regulated data sharing can create practical consumer benefits.

Customers often hold information across multiple banks, payment services and financial products.

With suitable authorisation, sharing relevant information can help participating providers deliver additional services.

The UAE Open Finance Framework

The Central Bank of the UAE introduced its Open Finance regulatory framework in 2024.

The original regulation was subsequently replaced by Circular No. 03/2025, issued on July 10, 2025.

The updated framework establishes requirements for regulated data sharing and transaction initiation within its scope.

It includes common infrastructure, an API hub and a trust framework designed to support approved participants.

What Consumers Could Gain

A customer using several participating financial institutions may be able to authorise an approved service to access specified information.

This could support consolidated financial views, spending analysis or relevant product comparisons.

However, consumers should understand which information is being shared, why it is required and which organisation will receive it.

Why Consent Matters

The UAE’s Open Finance framework places importance on explicit user consent for relevant personal data processing.

Consent must meet the applicable regulatory conditions.

Consumers should not be required to provide unrestricted access to unrelated financial information merely to use a limited service.

Open Finance Is Not Universal Portability

The framework applies to specified financial activities and regulated participants.

It does not mean that every social media, retail or healthcare platform must exchange information through the same system.

Its wider significance lies in showing how data-sharing standards, trusted participants and clear authorisation can support digital services.

Possible Business Opportunities

The commercial opportunity depends on customer demand, regulatory compliance and the reliability of the information-sharing arrangements.

Why Personal Data Portability Remains Difficult

Although portability offers important benefits, it is technically and legally complicated.

Different platforms organise information in different ways, and not every category of data can be transferred safely or meaningfully.

Incompatible Data Formats

Two platforms may store similar information using different structures.

For example, a fitness application may organise exercise records into categories that another service does not recognise.

A transfer could preserve the original measurements but lose associated labels or personalised settings.

Common technical standards can reduce these problems, but they require adoption by the participating providers.

Information Involving Other People

A social media export may include conversations, photographs and comments involving other individuals.

Transferring information without appropriate safeguards could affect their privacy.

Portability rights therefore need to be balanced against the rights of others.

Security During Transfers

Moving information between services creates additional opportunities for unauthorised access.

Attackers may attempt to impersonate users or obtain access through fraudulent applications.

Providers need secure authentication, suitable transfer methods and controls against inappropriate disclosure.

Commercial Resistance and Platform Lock-In

Some companies may have limited commercial incentives to make switching easier.

Customer histories, recommendations and personalised experiences can contribute to their competitive advantage.

Legal obligations and industry standards may encourage more interoperability, but implementation can remain difficult.

Cross-Border Legal Requirements

A transfer between providers in different countries may involve more than an ordinary data portability request.

Applicable international data-transfer rules, financial regulations and other restrictions may also need to be considered.

Portability rights do not automatically override these obligations.

Main Challenges Compared

The challenge is to make portability practical without weakening privacy or cybersecurity protections.

How Consumers Can Transfer Their Data Safely

Consumers do not need to wait for universal interoperability before taking steps to manage their information.

Many platforms already provide ways to download records or request copies of personal data.

However, the safest approach is to understand the export process before sharing information with another provider.

Step 1: Identify the Information Needed

A person changing cloud services may need photographs and documents.

Someone switching productivity applications may want calendars, contacts and task information.

Identifying the required categories helps avoid unnecessary transfers of sensitive records.

Step 2: Check Official Export Tools

Users should look for recognised download or transfer features within the existing platform.

For example, Google Takeout provides export options for supported account information.

A consumer should avoid unverified websites that request account passwords to perform a transfer.

Step 3: Review the Receiving Platform

Before exporting information, check whether the new service supports the relevant file formats.

A downloadable archive is less useful if the destination cannot import it.

Users should also examine the receiving provider’s privacy policy and security practices.

Step 4: Protect the Exported Files

Personal data archives can contain sensitive information.

They should be stored securely and deleted from unnecessary temporary locations after the transfer is complete.

Users should avoid sharing archives through unsecured public links.

Step 5: Verify the Transfer

After importing information, check whether important records are present and accurate.

This is particularly important for financial information, calendars, contacts and documents.

Step 6: Review the Original Account

Moving information does not necessarily remove it from the original provider.

Users should separately consider account closure, deletion options and applicable retention requirements.

Consumer Portability Checklist

• Identify the information you want to transfer.
• Use official export or transfer features.
• Verify the receiving service’s identity.
• Check supported file formats.
• Review privacy and security policies.
• Avoid sharing unnecessary sensitive information.
• Protect exported archives.
• Confirm the new platform imported records correctly.
• Revoke unnecessary third-party permissions.
• Review whether information should remain with the original provider.

This process can reduce the risks associated with changing digital services.

The Future of Personal Data Portability and FAQs

The future of data portability will depend on whether legal rights, technology standards and commercial systems develop together.

Privacy legislation can establish a right to obtain information, but consumers also need services capable of accepting and using that information.

Greater interoperability could improve consumer choice and create opportunities for innovative digital businesses.

However, information transfers must remain secure and legally appropriate.

The Role of Common Standards

Standardised file formats and application programming interfaces can make it easier for different services to exchange compatible information.

They may also reduce the work involved in building custom connections between individual platforms.

However, standards alone do not guarantee that all information can be transferred without losing functionality.

More Consumer-Controlled Digital Services

Future applications may allow users to authorise access to selected information without repeatedly uploading the same records.

Such arrangements could support financial services, productivity tools and other digital activities.

However, the information accessed should remain proportionate to the requested service.

What Businesses Should Prepare For

Companies handling customer information may face increasing expectations concerning transparency, data exports and interoperability.

They should maintain accurate records, understand applicable rights and establish procedures for responding to eligible requests.

Businesses should also avoid promising unrestricted transfers when the destination cannot accept the relevant information.

Frequently Asked Questions

What is personal data portability?

Personal data portability is the ability to receive certain personal information in a reusable format or transfer it to another provider, subject to applicable conditions.

Can consumers transfer their information between platforms?

Yes, in some circumstances. Actual transfers depend on available tools, supported formats, legal rights and the receiving platform’s capabilities.

Does the UAE recognise data portability rights?

Yes. Article 14 of the UAE’s federal Personal Data Protection Law establishes qualified rights to receive certain personal data and request its transfer where technically feasible.

Does Saudi Arabia have similar rights?

Saudi Arabia’s Personal Data Protection Law provides a right to request personal information in a readable and clear format, with additional conditions under its implementing regulations.

Can I move my photographs from Google to another service?

Google provides export tools and supported direct-transfer options. Available destinations and transferable content depend on the service.

Does exporting data delete the original information?

No. Exporting or copying data generally does not automatically delete it from the original provider.

Can all banking information be transferred between UAE financial institutions?

Not automatically. The UAE Open Finance Framework supports regulated, authorised sharing within its defined scope.

Is data portability the same as data ownership?

No. Portability concerns obtaining and reusing eligible information. Legal ownership, privacy rights and organisational responsibilities are separate issues.

Can a company refuse a portability request?

A request may be restricted by applicable legal conditions, exemptions, third-party rights or technical limitations. The answer depends on the governing law and circumstances.

Will data portability eliminate platform lock-in?

It may reduce switching barriers, but differences in software functionality, file formats and commercial arrangements can remain.

Final Thoughts

Personal data portability is becoming an important part of the relationship between consumers and digital platforms.

As people use more online services, the ability to obtain and reuse information can affect privacy, convenience and freedom of choice.

The UAE has established a qualified statutory right to transfer certain personal data, while Saudi Arabia provides rights to request information in a usable electronic format.

Major technology companies also offer tools that allow users to export or copy selected records.

However, full portability requires more than downloading files.

Services must be technically compatible, protect personal information and respect the legal obligations associated with transferring data.

For consumers, the opportunity is greater control over their digital records. For businesses, portability may encourage competition and the development of useful new services.

Ultimately, personal data portability could make changing digital platforms less complicated and reduce dependence on individual providers.

Its long-term success will depend on making data transfers not only legally possible, but also secure, understandable and genuinely useful.

Do follow us on Instagram

Read More – UAE Vibe Coding Initiative: 7 Powerful Ways to Build Apps Without Coding