Question

A privacy engineer is designing the data-subject data portability feature for a SaaS HR platform. The regulation requires that individuals be able to receive their personal data and transmit it to another controller without hindrance. The product team proposes exporting each individual's records as a rendered PDF report because it is easy to generate from the existing reporting module. What is the engineer's BEST response to satisfy the portability requirement?

Accepted Answer

Require the export to be in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so the data can be reused and transmitted to another controller.

Answer

Accept the PDF because it contains all the individual's personal data and is human-readable.

Answer

Provide the PDF but add an option to encrypt it with the individual's password to ensure security during transfer.

Answer

Export only aggregated summary statistics to minimize the personal data disclosed in the portability response.