Users can export their data in a structured, machine-readable format

GDPR Art. 20 grants data subjects the right to receive data they have 'provided' in a structured, commonly used, machine-readable format. This is not satisfied by a PDF, an HTML page, or a JSON blob full of abbreviated field names like ts, uid, and evt. The portability right exists specifically so users can take their data to a competing service — which requires a format that a human or automated import tool can interpret without a technical manual. Failing to provide a self-documenting, versioned export also makes your own DSAR compliance fragile: if the schema changes and old exports are unreadable, you have no durable evidence trail.

Ensure your export endpoint produces a self-documenting JSON structure with a _meta block, full field names, and a format version.

{
  "_meta": {
    "exportedAt": "2026-02-22T10:00:00Z",
    "formatVersion": "1.0",
    "schemaDescription": "Personal data export. Timestamps are UTC ISO 8601. IDs are UUIDs.",
    "schemaUrl": "https://example.com/docs/data-export-schema"
  },
  "profile": {
    "userId": "usr_abc123",
    "emailAddress": "alice@example.com",
    "displayName": "Alice",
    "accountCreatedAt": "2025-06-01T09:00:00Z"
  },
  "contentCreated": [
    { "itemId": "item_xyz", "title": "My first post", "createdAt": "2025-07-15T14:30:00Z" }
  ]
}

Use full, descriptive field names throughout — never abbreviated database column names. Increment formatVersion whenever the schema changes so older exports remain interpretable. Include the _meta block in your existing app/api/user/export/route.ts response.