Designing data portability and machine-readable export UI in Figma: formats, scopes, and delivery

Quick answer

Data portability UI lets users request a structured copy of personal data they provided or that was observed about them—delivered in a machine-readable format they can reuse elsewhere. Design a self-service export hub with scope selection (profile, activity, purchases), format pickers (JSON, CSV, ZIP bundle), and secure delivery (time-limited download link + email receipt). Start from the Figma guides hub and pair with DSAR portal, privacy settings, consent withdrawal, compliance exports, and Dev Mode handoff.

---

Who this is for

• Product designers building self-service “download my data” flows in account settings or privacy portals.
• Privacy engineers defining export schemas, redaction rules, and cross-system bundle assembly.
• Legal and compliance teams separating portability (Art. 20) from full access (Art. 15) and erasure (Art. 17).

---

Data portability hub (internal overview)

PortabilityHub — Acme App · 842 exports last 30d · Avg bundle 12.4 MB · SLA 72h
├── Header: Pending 23 · Failed 2 · Median completion 4.1h · Largest bundle 890 MB
├── Actions: [ New export template ] [ Retry failed ] [ Audit log ] [ Schema docs ]
├── Tabs: Requests · Templates · Formats · Redaction rules · Delivery · Incidents
├── Alert: Export EX-9921 · User hit 3/day rate limit · Possible automation abuse
├── Filters: Region · Status · Format · Scope · Date range
└── Link: [DSAR portal](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · [Privacy settings](/designing-privacy-settings-and-data-management-ui-in-figma/) · ROPA · DPA hub

Section	Purpose
Requests	User-initiated and DSAR-linked export jobs
Templates	Predefined scope + format bundles per product surface
Formats	JSON, CSV, XML, PDF summary, media attachments
Redaction rules	Strip third-party PII, secrets, derived scores where not portable
Delivery	Signed URLs, expiry, re-auth before download
Incidents	Failed jobs, oversized bundles, schema drift

Verdict: Portability fails when the export is a PDF screenshot of settings—users need structured, reusable data.

---

Self-service export request (customer-facing)

ExportMyData — Privacy · Download a copy of your data
├── What you can export (portability scopes):
│   ├── ☑ Profile and account info · Name, email, preferences · JSON, CSV
│   ├── ☑ Activity history · Posts, comments, likes · JSON (recommended)
│   ├── ☐ Purchase records · Orders, receipts · CSV · Contract basis included
│   └── ☐ Connected services · OAuth tokens metadata only · No third-party secrets
├── Format: (•) JSON bundle (recommended) · ( ) CSV per table · ( ) ZIP with attachments
├── Delivery: Email link when ready · Link expires in 7 days · Re-login required to download
├── Not included: Other users' messages, fraud scores, internal support notes
├── Estimated size: ~8 MB · Typical wait: under 4 hours
├── Legal note: Right to data portability (GDPR Art. 20) · Differs from full DSAR access
└── [ Request export ] · [ View past exports ] · [ Open full DSAR ](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/)

Rule	Implementation
Scope clarity	List each category with plain-language contents
Format guidance	Recommend JSON for interoperability; CSV for spreadsheets
Honest exclusions	Explain derived/inferred data and third-party limits upfront
Separate from erasure	Do not conflate export with consent withdrawal or delete
Rate limits	Show daily cap to prevent abuse without hiding the right

---

Export progress and status

ExportStatus — Request #EX-2026-44102 · Requested Aug 11 03:22 UTC
├── Status: Processing · Step 3 of 5 · Assembling activity feed
├── Progress bar: 62% · ETA ~45 minutes
├── Scopes: Profile ✓ · Activity in progress · Purchases queued
├── Format: JSON bundle · Schema version 2.4 · [ View schema docs ]
├── Notifications: Email when ready · In-app badge on Privacy page
├── Cancel: [ Cancel request ] · Available until assembly starts
└── Past exports: Aug 3 · Completed · Link expired · [ Request again ]

Show real pipeline stages—“Processing” for 48 hours erodes trust and invites regulator complaints.

---

Secure delivery and download

ExportReady — Your data export is ready
├── Bundle: acme-export-EX-44102.zip · 11.2 MB · JSON + CSV + README
├── Contents summary:
│   ├── profile.json · account.json · activity.json
│   ├── purchases.csv · connections.json
│   └── README.txt · Schema URLs · Redaction notes
├── Security:
│   ├── Link expires: Aug 18 2026 · One-time download optional toggle
│   ├── [ Verify identity ] · Password or 2FA required · [Session timeout](/designing-session-timeout-and-re-authentication-ui-in-figma/) pattern
│   └── Do not forward this email · Contains personal data
├── After download: [ Delete server copy now ] · Auto-delete in 7 days regardless
└── [ Download export ] · [ Report problem ] · Receipt #EX-44102 stored in audit log

Pair re-auth with security settings—exports are high-value targets for account takeover.

---

Admin: export template and schema editor

ExportTemplateAdmin — activity_history · v2.4
├── Portable fields: post_id, body, created_at, visibility · Source: posts_db
├── Excluded: moderation_flags, internal_quality_score · Reason: not provided by user
├── Redaction: Strip @mentions of non-exporting users → user_id hash
├── Output: activity.json · JSON Schema URL · CSV fallback columns
├── Linked ROPA: PA-104 Product analytics · PA-88 User-generated content
├── DSAR parity: Same bundle used for Art. 15 access when scope = portability
├── SLA: 95% complete < 24h · Max bundle 2 GB · Split oversized into parts
└── [ Test export for @qa-user ] · [ Diff vs v2.3 schema ]

Legal, engineering, and design share field inventories—UI labels must match export contents exactly.

---

Comparison: portability vs access vs erasure

Right	User gets	Typical format	UI surface
Portability (Art. 20)	Data they provided + observed activity	JSON, CSV, structured ZIP	Self-service export hub
Access (Art. 15)	Broader copy including inferred data	PDF summary + structured bundle	DSAR portal
Erasure (Art. 17)	Deletion confirmation	N/A	Privacy settings delete flow
Rectification (Art. 16)	Correct inaccurate fields	Inline edit, not export	Profile settings

Use distinct entry points—one “download everything” button blurs legal bases and creates review risk.

---

Handoff checklist (Dev Mode)

• ExportRequest — request_id, user_id, scopes[], format, status, requested_at, completed_at.
• ExportScope — scope_id, label, description, included_fields[], excluded_fields[], legal_basis.
• ExportBundle — bundle_id, request_id, file_urls[], size_bytes, schema_version, checksum.
• DeliveryLink — link_id, bundle_id, expires_at, download_count, requires_reauth.
• ExportTemplate — template_id, scopes[], format_defaults, redaction_rules[], sla_hours.
• ExportReceipt — receipt_id, request_id, downloaded_at, ip_hash, user_agent_hash.
• Accessibility — progress announced to screen readers; format options not radio-only color cues; download errors readable.

---

Common mistakes

Mistake	Why it hurts	Fix
PDF-only export	Fails machine-readable requirement	Offer JSON/CSV as primary
Including third-party secrets	Security and contract breach	Metadata only for OAuth connections
No schema documentation	Data unusable at destination	README + JSON Schema links in bundle
Same flow as full DSAR	Wrong legal basis timing	Separate portability vs access scopes
Permanent download links	Leak risk after email forward	Expiry + optional one-time use
No re-auth on download	Account takeover exfiltration	Step-up auth before file access
Hidden rate limits	User frustration	Show caps in UI before submit
Stale export templates	Schema drift breaks importers	Version templates; notify on breaking changes

---

Recommended workflow

1. Inventory portable fields with Legal—map to ROPA activities.
2. Design self-service hub in privacy settings with scope + format pickers.
3. Add progress and ETA tied to real pipeline stages.
4. Ship secure delivery with expiry, re-auth, and auto-delete.
5. Document schemas for engineering and downstream importers.
6. Wire DSAR portal so Art. 15 requests can reuse templates with broader scopes.
7. Log every download in audit trail for compliance exports.

---

FAQ

Same as DSAR access?

Portability is a subset focused on structured, reusable data the user provided or that was observed; access can include inferred scores, internal notes, and PDF summaries.

Can users export after consent withdrawal?

Yes for data still held under contract or legal obligation; withdrawn scopes should not appear in new exports—show what was removed.

Import elsewhere?

Include README with schema URLs; consider linking to connected accounts for OAuth-based importers where you support them.

B2B org exports?

Enterprise admins may export org metadata separately—do not bundle employee PII without role checks and team permissions.

Legal hold?

Block deletion of pending export bundles when legal hold applies—show hold badge on status screen.

---

Next steps

• Design data subject access request and GDPR portal UI in Figma — full access requests beyond portability
• Design privacy settings and data management UI in Figma — host export entry points
• Design consent withdrawal and downstream deletion UI in Figma — align scopes when users revoke
• Design records of processing activities and data mapping UI in Figma — field inventories for export templates
• Design compliance exports and legal hold UI in Figma — audit bundles for regulators