NIST Privacy Framework, Control-PCT.DM-P6

For connected products, and the services related to them, placed on the market after 12 September 2026 (Article 50), design and manufacture the connected product, and design and provide the related service, so that product data and related service data, including the relevant metadata necessary to interpret and use those data, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible to the user (Article 3(1)).

Where data cannot be directly accessed by the user from the connected product or related service, make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time, on the basis of a simple request through electronic means where technically feasible (Article 4(1)).

Let a natural person, or their representative under Article 4(2), download free of charge an electronic copy of at least their personal electronic health data in the priority categories of Article 14, through the electronic health data access services, in the European electronic health record exchange format of Article 15 (Article 3(2)).

Where the healthcare providers are in different Member States, transmit a natural person's personal electronic health data on their request in the European electronic health record exchange format through the cross-border infrastructure of Article 23, and as the receiving healthcare provider accept such data and be able to read them (Article 7(2)).

If you are a health services provider treating a patient, forward the personal health data you consider relevant, necessary and proportionate to another provider also treating the patient, in a digital format using the standards in the guidelines and within the period they specify (Health Information Act 2026 Section 7).

Give a person a copy of their data in a structured, commonly used, machine-readable electronic format on request, and do not oppose the person transmitting their data to another controller, as far as the state of technology allows.

An app holding the personal information of an individual in the Philippines must give that individual a way to be informed, object, access, correct, and erase their data, and must provide a copy of their data in a structured, commonly used, machine-readable format on request.

Provide a data subject's personal data in a structured, machine-readable and interoperable format on a portability request.

Where processing rests on a contract or consent and is carried out by automated means, give the data subject their personal data in a structured, commonly used, machine readable format, and transmit it directly to another controller where technically feasible.

On request, give a data subject a copy of personal information processed by electronic means in a structured and commonly used electronic format.