Identity data portability is the ability to take the information and credentials that make up your digital identity from one provider and use them with another, without starting from scratch. It covers profile data, contact lists, saved passwords, passkeys and, increasingly, digital credentials stored in wallets.
Portability gives people leverage: if a service changes its terms, raises prices or shuts down, you can leave without losing your history. This article explains what can be moved, the legal and technical foundations, the security risks of exported files, and how individuals and organizations can plan a clean move.
Why Leaving a Provider Should Not Mean Losing Yourself
Many people stay with an email provider, social network or password manager mainly because switching feels too painful. Years of messages, contacts, saved logins and account connections sit in one place, and rebuilding them elsewhere seems impossible. This situation is often called vendor lock-in.
Lock-in matters for identity because your email address and sign-in accounts act as keys to many other services. If a provider suspends your account or closes, every service that relies on it for recovery or sign-in becomes harder to reach.
Portability reduces that dependency. When you can export your data in a usable format and import it elsewhere, the decision to stay becomes a real choice. For organizations, the same principle applies to directories and identity platforms, where migrations can otherwise take months.
What Counts as Portable Identity Data
Identity data spans more than a profile page. Before planning a move, it helps to sort it into categories, because each category exports differently and carries different risks.
- Profile attributes such as name, contact details, preferences and profile photos.
- Content and history, including messages, posts, documents and purchase records linked to the account.
- Contacts and relationships, like address books, followers, groups and shared folders.
- Credentials, meaning saved passwords, passkeys, authenticator app entries and recovery codes.
- Issued credentials, such as digital membership cards or verifiable credentials stored in a wallet.
Some data cannot move. Inferred analytics, internal risk scores and reputation signals usually stay with the original provider. Credentials tied to specific hardware may also be designed never to leave the device, which protects them from theft but limits portability.
The Legal Right to Data Portability
In the European Union, the GDPR includes a right to data portability. In broad terms, it lets individuals receive personal data they provided to an organization in a structured, commonly used and machine-readable format, and in some cases have it sent directly to another organization.
The right has limits. It generally applies to data you provided or that was observed from your use of the service, under certain legal bases, and not to every inference an organization makes. Other countries and some US states have their own access or portability rights with different scopes.
Because rules vary, check the privacy notice of the service and the data protection authority in your country before relying on a specific right. The practical first step is the same everywhere: look for a download or export tool in the account’s privacy settings and test what it produces.
Formats and Standards That Make Moves Work
An export is only useful if another service can read it. Portability depends on shared formats and protocols, and the identity field has several that matter for both individuals and organizations.
Common Export Formats
Exports usually arrive as JSON, a structured text format readable by software, or CSV, a simple spreadsheet format. Contacts often use vCard and calendars use iCalendar, both widely supported standards.
Machine-readable formats matter because a folder of screenshots or PDFs cannot be imported automatically. When an export tool offers several formats, choose the structured option for importing and a readable copy for your own records.
Standards for Directories and Accounts
Organizations moving users between identity systems often rely on SCIM, the System for Cross-domain Identity Management. It defines a standard way to create, update and remove user accounts across services.
Using SCIM-capable systems means user records, group memberships and attributes can be synchronized or migrated without custom scripts for every application, which lowers the effort and errors involved in switching identity platforms.
Portable Credentials and Wallets
W3C Verifiable Credentials are digital credentials signed by an issuer, such as a university, that the holder stores and presents. Because the proof is cryptographic and the format is standardized, the same credential can be checked by many verifiers.
In principle this makes credentials portable between compatible wallets. In practice, support differs across wallets, so check whether a wallet allows exporting or backing up credentials before relying on it.
Moving Passwords and Passkeys
Credentials are the most sensitive part of any identity move. Most password managers can export saved logins and import exports from competitors, typically as a CSV file. That file usually contains every username and password in plain, unencrypted text.
Passkeys are harder to move because their private keys are designed to stay protected inside a platform or device. Industry groups have been working on standard ways to transfer passkeys securely between credential managers, but support varies, so check what your current and new providers offer.
Where a direct transfer is not available, a reliable alternative is to sign in to each important service with your old method and register a new passkey in the new manager. This takes longer but avoids handling exported private keys and confirms each account works before the old manager is retired.
Phone Numbers and Email Addresses as Portable Identifiers
Phone numbers and email addresses work as identifiers, meaning values that point to one person across many services. Their portability shapes your identity more than most exports do, because banks, delivery apps and messaging services use them to recognize you and send recovery codes.
Many countries let customers keep a mobile number when changing carriers, a process called number porting. Criminals abuse a related process in port-out fraud and SIM swap attacks, moving a victim’s number to a device they control. Ask your carrier about an account PIN or port-out protection.
Email addresses usually cannot move between providers unless they use your own domain. When you change email, every account using the old address for recovery needs updating. Moving important accounts away from text-message codes toward passkeys or authenticator apps also reduces dependence on a number you might change.
Security Risks of Exported Identity Data
An export file is a concentrated copy of your identity. Left in a downloads folder, synced to cloud storage or attached to an email, it can expose years of personal information in a single file. Treat every export as highly sensitive from the moment it arrives.
Attackers also know about export tools. If someone gains access to your account, requesting a full data export is a quick way to take everything at once. Many services send a notification when an export is requested, so never ignore one you did not start.
Credential exports are especially dangerous. A plain-text password file on a shared computer could hand over every account you own. Keep such files on an encrypted device, use them immediately, and securely delete them afterward, including from any trash or backup folders.
A Step-by-Step Personal Migration Plan
A careful move takes planning but rarely more than an afternoon for most people. The order matters, because some accounts provide recovery for others and should be moved last.
- List the accounts that depend on the old provider, such as services using its email for recovery or sign-in.
- Request a full export and check that it opens correctly before changing anything else.
- Set up the new account with strong multi-factor authentication and recovery options first.
- Import data, then update recovery emails and sign-in methods on dependent services one at a time.
- Keep the old account active for a transition period, then delete it and remove leftover exports.
A transition period catches messages and password resets still arriving at the old address. Forwarding rules, where available, help during this time, but remove them before closing the old account.
Portability for Organizations and Developers
Organizations hold identity data for employees and customers, and they face portability obligations as well as migration needs. When people exercise access or portability rights, teams must locate their data across systems and produce it in a usable format within the time the law allows.
Developers can make this easier by designing export from the start. Keeping identity attributes in well-defined fields, documenting data locations and offering a self-service export reduces manual work. Including security notifications and re-authentication before an export protects users from attackers abusing the feature.
When switching identity platforms, plan how password hashes, multi-factor enrollments and federation settings will move. Some cannot be transferred directly, so users may need to re-enroll factors. Communicating this early reduces support calls and the temptation to weaken security during the switch.
Limits and Trade-Offs of Portability
Portability does not guarantee that a new provider will treat your data better. Moving data to a service with weaker privacy practices can reduce protection. Before importing, read how the new provider uses imported contacts and content, especially information about other people.
That point matters because many exports include data about others, such as friends’ messages or shared photos. Importing them into a new service may share their information without their knowledge. Consider removing third-party content you do not need before importing.
There is also a tension between portability and security. Credentials that are easy to export can be easier to steal. Strong designs balance the two with re-authentication, encryption during transfer and notification of every export.
Keeping Your Identity Ready to Move
The easiest migration is one you prepared for. Using standard formats and services that offer clear export tools keeps future options open. When choosing a new provider, check for a documented export feature before you commit years of data to it.
Consider using an email address on a domain you control for important accounts. If you ever change email providers, the address stays the same, so dependent services do not need updating. Domain renewals then become important, so set reminders and enable automatic renewal.
Test exports once a year for your most important accounts. Confirm the files open, contain what you expect, and are stored securely or deleted. That small habit means a sudden closure, policy change or account problem becomes an inconvenience rather than a loss of identity.