Fetch and update data

A data subject has the right to access their personally identifiable information (PII) data and have it updated.

You should automate updates, letting the data subject update personal data from your website. You should also be able to process a subject access request (SAR) if the data subject emails or calls you for their PII data.

The right to data portability states that a data subject has the right to receive their PII data in some data format that lets them move their data from one data controller to another. GDPR does not state what format this has to be in, but you should keep it simple and in some widely-used format, such as comma-separated values (CSV).