Which smart-device data must customers export?
Customers can receive personal data they supplied, including observed device-use data, where processing is automated and based on consent or contract. The export must be structured, commonly used and machine-readable; inferred profiles fall outside portability. Agree supplier support before ordering with Cambridge China Bridge.
Check which processing qualifies
Portability applies to the customer's personal data provided to you where automated processing relies on consent or performance of a contract. Apply that test to each processing purpose rather than promising that every record held by the product is portable.
Before choosing a supplier, map what the device, app and cloud service collect, where each record sits and who can retrieve it. Keep the product-security checks in our connectable products guide alongside this data-export review.
Include observed data, separate inferred profiles
Provided data includes information entered by the customer and personal data observed through their use of a device or service. The ICO gives location data and raw data from smart meters and wearables as examples. Ask for a field list showing which records are entered, observed or generated by analysis.
Profiles created by analysing supplied data fall outside portability. However, inferred or derived personal data may still need to be supplied under a subject access request. If a customer asks for their records and profile together, assess both rights rather than excluding the profile from the whole response.
Specify an export another system can read
The export must be structured, commonly used and machine-readable. The ICO identifies CSV, XML and JSON as suitable examples, without making those formats compulsory. Ask the supplier to demonstrate extraction of individual fields; a screenshot of an app dashboard does not demonstrate this.
For procurement acceptance, request sample files with field descriptions, units, timestamps, time-zone conventions and explanations of missing values. Test whether another application can read them without the supplier's account or proprietary viewer. Put the export deliverables into your product specification.
Plan secure delivery and direct transfers
Customers can receive their qualifying data and request direct transmission to another organisation. Direct transmission must be carried out where technically feasible. This does not require maintaining systems technically compatible with every other organisation, but delivery must be secure and reach the correct destination.
Ask the supplier to demonstrate both customer downloads and the handling of a direct-transfer request. For shared household devices, review whether transmission would adversely affect other people's rights and freedoms. Test account separation with synthetic records before using customer information.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Agree supplier support before ordering
Name the people responsible for retrieving device, app and cloud records, converting files and fixing failed exports. Agree escalation contacts, support arrangements after the final order and how exports will remain available if the cloud provider changes. These are purchasing safeguards to negotiate, rather than a prescribed export-support package.
Keep an approved sample export and repeat the check when firmware or app behaviour changes. Use our firmware approval guide to record the tested configuration. Cambridge China Bridge can use the agreed brief when discussing requirements with suppliers through its own staff in China.
Frequently asked questions
Does portability cover data recorded by a wearable?
It can cover observed personal data, including raw wearable records, where automated processing relies on consent or performance of a contract. It is not limited to details the customer typed in.
Must we export customer profiles and predictions?
Profiles created from supplied data fall outside portability. Inferred or derived personal data may still fall within a subject access request, so assess a combined request under both rights.
Which file format should we ask the factory for?
Ask for a structured, commonly used, machine-readable export. CSV, XML and JSON are examples, not compulsory choices. Test the actual file and field descriptions before approving the product.
Must we transfer data straight to another provider?
Yes, where the customer requests it and direct transmission is technically feasible. Agree secure delivery and test the supplier's support route before ordering.