“You own your data” is not an operating model. Use this guide to turn the principle into specific questions for product, legal, privacy and procurement teams.
Build a data register
For member identity, profiles, content, groups, documents, events, support, moderation, analytics, security logs and backups, record:
- source and accountable organisation;
- purpose;
- people and systems with access;
- member-visible audience;
- processor and location;
- retention trigger and period;
- export format;
- deletion or anonymisation action.
Define party roles
Document what the community operator decides, what the software provider processes, what members contribute and where another supplier is involved. Align the result with contract and privacy terminology after professional review.
Test practical control
Can administrators use least-privilege roles? Can members understand profile visibility? Can the organisation correct and export information? What happens to an account and contributions when a person leaves?
Examine commercial use
Ask whether information is sold, used for behavioural advertising, combined across services or used for AI training. Review licences, analytics, derived data and product-improvement terms.
Portal Page intends that organisations pay for software and private community content does not automatically become training material. Final terms and controls must make that position binding.
Specify portability
List required content, metadata, relationships and configurations. Choose usable, documented formats. Define protected delivery, assistance, timing, verification and cost.
Account for member privacy, third-party rights and formal records. An export is not permission to redistribute everything.
Specify service exit
Set notice, final export, transition support, active-system deletion, backup lifecycle, security-log retention and confirmation. Test the process before it becomes urgent.
Read Portal Page’s full data ownership framework and obtain legal advice for the actual arrangement.