GDPR Article 20 Gives You the Right to Leave Your Accounting Software. Most Vendors Pray You Don't Know.
Data Portability Rights and Their Impact on Accounting Software Market Dynamics
---
Somewhere in the settings menu of your accounting software — probably under a section labeled "Data Export" that nobody on your finance team has ever visited — there is a legal obligation your vendor is quietly fulfilling. EU law requires them to give you every invoice, every transaction, every chart-of-accounts entry in a machine-readable format, within 30 days, free of charge, if you ask for it.
That right comes from GDPR Article 20 — the right to data portability. It applies to accounting software in the same way it applies to health apps and social networks. You can invoke it today. Your vendor must comply.
CFOs have almost universally never exercised it. Vendors are counting on that.
---
What the Law Says
GDPR Article 20 gives any business that stores its financial data with a software vendor the right to receive that data back — in a format that can actually be used somewhere else — within 30 days, free of charge. For accounting software, this covers supplier records, client financial data, employee payroll entries, and the full transaction history that references all of them.
Compliance with that right is not optional, not subject to the vendor's goodwill, and not contingent on renewal negotiations. France's data protection authority, the CNIL, has explicitly confirmed that Article 20 applies to professional accounting and business software, not just consumer applications.
Under the regulation, you are entitled to: all personal data contained in your accounting system, in a format your IT team can work with (a spreadsheet you can open, or a structured file any other accounting system can read — not a locked PDF that exists purely to frustrate migration), delivered within 30 days of a formal written request, at no additional charge.
---
The Gap Between the Right and Reality
Knowing about the right is the first step. Getting something useful from it is where most CFOs discover the second problem.
When PennyLane launched a migration tool in 2023 targeting Sage 50 clients, historical transaction data imports completed at an average rate of 73% — meaning roughly one in four historical entries required manual reconstruction by accounting staff. Xero's data portability documentation lists 14 data types that export cleanly and six that require "additional preparation" — their phrase for manual work that Xero is not offering to do for you. A 2024 survey by Accountancy Age found that 41% of UK SMEs that switched accounting software in the previous two years reported losing historical report configurations they had to rebuild from scratch.
These outcomes are not coincidental. Vendors spend real engineering budget on one feature they never mention in sales calls: making your data difficult to use anywhere else. Export formats that require specialist tools to open. Incomplete data mappings where the receiving system cannot make sense of the codes the old system used. Transaction histories that export without their attached documents. Chart-of-accounts structures that translate differently across systems and require manual reconciliation after migration.
Mid-market companies that have gone through accounting software migrations report spending €30,000 to €80,000 on data migration consultants — after receiving their GDPR export, not before. The law gives you the right to receive your data. It does not guarantee that data arrives in a form you can use without significant investment.
---
How to Make the Right Work
There is a meaningful difference between clicking the self-service export button in your software's settings and submitting a formal Article 20 request to the vendor's Data Protection Officer. Both are legal instruments. They do not receive the same response.
Vendors that take GDPR compliance seriously have separate workflows for formal data subject requests. These workflows tend to produce more complete exports than the self-service tool because they involve actual compliance staff reviewing what was delivered. A formal written request, citing Article 20 by name, addressed to the DPO and sent to the vendor's GDPR contact email, creates a record that a data protection authority can audit. Self-service exports do not.
Accounting vendors satisfy their technical compliance obligation through the self-service tool and hope you never escalate. Finance teams that submit formal requests before renewal discussions consistently report receiving more complete data sets — and that the act of requesting creates a different quality of conversation with the vendor's account team.
No accounting software vendor has ever run a marketing campaign that says: "By the way, EU law requires us to give you all your data back on request within 30 days." They satisfy the legal obligation quietly, in a settings menu most users never find. Claiming the right actively — in writing, citing the regulation — is what produces results.
---
What the Right Doesn't Cover
Article 20 covers what you entered: invoices, transactions, journal entries, supplier records, client data, payroll history. It does not cover what the software created: custom report templates, workflow automations, configured integrations, month-end close checklists you built over three years of use.
Every CFO who's gone through a migration reports that the covered data — the raw transactions — transferred reasonably well. The uncovered data — the three-year-old custom P&L format, the automated intercompany reconciliation rules, the approval workflows configured to match your company's structure — is what actually cost time and money to recreate.
Raw transaction history comes back. Institutional knowledge of how to use the software to do your finance team's specific job does not. That distinction matters when you're calculating the true cost of a migration.
---
The Ratchet You're Sitting On
Each year in accounting software adds switching cost asymmetrically. Transaction history grows linearly. Custom configurations grow faster. After year one, migration is manageable. After year three, it's a project with a budget. After year five, it's a transformation program that requires executive sponsorship.
Your vendor knows this. Their product roadmap includes features designed to raise your switching cost every quarter — integrations that become load-bearing, configurations that become institutional processes, report formats that become how your board expects to see financial data. None of these are malicious. Every one makes leaving harder.
Invoking Article 20 gives you a current snapshot of your exact position on that ratchet, at no cost, within 30 days of asking. Finance teams that request their portability export annually — actually reviewing what comes back and assessing how usable it is — keep a realistic picture of their true switching cost. Those that never request it tend to wildly overestimate or underestimate it, usually when they're already mid-negotiation.
---
The Quotable Position
Most accounting software vendors aren't breaking the law when they make your data hard to use elsewhere. They're making sure the legal minimum — a machine-readable export — is painful enough to work with that you never actually leave. That's not a violation. It's a business model.
EU law has a response to that business model: it has existed since 2018, and it shifts the negotiating dynamic when finance teams know it and use it. CFOs who request their portability export before renewal discussions consistently report better outcomes — either because the vendor improves their product to make switching feel less necessary, or because the CFO gains the position to negotiate terms that reflect a lower switching premium.
---
What Comes Next
By 2027, the EU Data Act — which extends portability rights beyond personal data to all business-generated operational data — will apply to accounting software. This means the portability right you currently have under Article 20 (covering personal data in supplier and client records) will be joined by a broader right covering the operational data GDPR currently excludes: transaction records, financial histories, chart-of-accounts structures.
Any vendor who's relied on the gap between GDPR's personal data scope and the wider operational data in their systems is approaching a compliance inflection point. The question for CFOs isn't whether portability will improve — it will. The question is whether to act under today's rights or wait for broader ones that arrive in 2027.
Finance data belongs to the business that generated it. The law says so, has said so since 2018, and is about to say so more emphatically. Whether you use that fact in your next renewal conversation is a decision with a direct financial outcome.