Section 38: Data portability

(1) The Commission may make regulations establishing a right of personal data portability.
(2) Right of data portability under this Act shall entitle the data subject to –
(a) receive, without undue delay from a data controller, personal data concerning the data subject in a structured, commonly used, and machine-readable format;
(b) transmit the personal data obtained under paragraph (a) to another data controller without any hindrance; and
(c) where technically possible, have the personal data transmitted directly from one data controller to another.
(3) The Commission may prescribe –
(a) circumstances and conditions on which the data subject may exercise the right of data portability; and
(b) the obligations it would impose on a data controller or data processor, or categories of data controllers or data processors, including in relation to costs and timing.