How do I handle exports that take longer than 5 minutes to generate?

Use an async job queue. Return a 202 Accepted response with a job ID immediately. Process the export in a background worker that streams rows to a file rather than loading everything into memory. Notify the user via in-app notification or email when the file is ready. Include a progress indicator if the export page is still open. The [glossary entry on asynchronous processing](/glossary/prioritization) covers the underlying pattern.

Should I let users export data they have read access to but do not own?

Yes, if the user has legitimate read access (e.g., a team member viewing shared project tasks), they should be able to export what they can see. The export permission model should mirror the view permission model. The exception is PII fields: even if a team member can see a colleague's email in the UI, bulk export of those emails should require admin-level access and generate an audit log entry. See the [Permissions Specification Template](/templates/permissions-spec-template) for structuring role-based access.

What encoding should CSV exports use?

UTF-8 with a byte order mark (BOM). The BOM is a 3-byte prefix that tells Excel to interpret the file as UTF-8 instead of its default encoding. Without the BOM, Excel on Windows garbles non-ASCII characters (accented names, CJK text, emoji). Google Sheets and most BI tools handle UTF-8 with or without BOM correctly.

How do I make exports GDPR-compliant?

GDPR Article 20 requires data portability in a "structured, commonly used and machine-readable format." CSV and JSON both qualify. The export must include all personal data you hold about the requesting individual. Deliver within 30 days (though faster is expected). Log every GDPR export request separately from regular exports. Strip data belonging to other users from the export even if the requesting user has admin access. The [PRD Template](/templates/prd-template) includes a compliance section where you can document these requirements. ---

Data Export Specification Template

What This Template Is For

Data export is a feature every SaaS product eventually needs. Customers want to pull their data into spreadsheets, BI tools, data warehouses, or competing products. Regulators require it under GDPR Article 20 and CCPA. And your own internal teams need bulk exports for reporting, audits, and analytics.

Despite its ubiquity, data export is frequently underspecified. Teams ship a CSV download button and call it done, then spend the next quarter fielding support tickets about missing fields, broken encodings, timeout errors on large datasets, and exports that include data the user should not have access to.

This template forces you to think through format options, field selection, filtering, permissions, scheduling, large dataset handling, and privacy compliance before writing code. It applies to any product that stores user-generated data.

Pair this with the Feature Specification Template if the export is part of a larger feature. For guidance on how data capabilities fit into product strategy, see the Product Strategy Handbook. Use the RICE Calculator to prioritize export against competing feature requests.

How to Use This Template

Start by listing every data entity users might want to export. Talk to support about the most common export requests. Check your GDPR/CCPA request log for patterns.
Define export formats based on your users' downstream tools. CSV covers spreadsheets. JSON covers developer integrations. PDF covers compliance and audits.
Map permissions carefully. A team admin exporting "all team data" should not include data from other teams in a multi-tenant system.
Specify large dataset handling early. If your largest customer has 2M rows, a synchronous CSV download will time out. Async exports with email delivery or download links are the standard pattern.
Include privacy annotations for every field. Some fields should never appear in exports (hashed passwords, internal IDs). Others require redaction in certain contexts (PII in GDPR subject access requests versus internal analytics exports).
Review with engineering, security, and legal before implementation.

The Template

Export Feature Overview

Field	Details
Feature Name	[Name]
Author	[PM name]
Engineering Lead	[Name]
Target Release	[Date or milestone]
Status	Draft / In Review / Approved

Summary. [1-2 sentences: what data can be exported, by whom, and why.]

User Stories.

As a [role], I want to export [data type] so that I can [goal].
As a [role], I want to schedule recurring exports so that [goal].
As an admin, I want to export all team data for [compliance / audit / migration] purposes.

Exportable Data Entities

Entity	Fields Included	Default Fields	Max Rows (estimated)	Permissions Required
[Entity 1]	[All / Subset]	[List default fields]	[Estimate]	[Role or scope]
[Entity 2]	[All / Subset]	[List default fields]	[Estimate]	[Role or scope]

Export Formats

Format	Use Case	Encoding	Max File Size	Notes
CSV	Spreadsheets, BI tools	UTF-8 with BOM	[Limit]	Delimiter: comma. Quotes around fields containing commas.
JSON	Developer integrations, API consumers	UTF-8	[Limit]	Nested objects for relationships.
XLSX	Excel users, non-technical stakeholders	N/A	[Limit]	Formatted headers, auto-column-width.
PDF	Compliance, audits, executive summaries	N/A	[Limit]	Paginated, includes generation timestamp.

Filtering and Field Selection

Filter Options.

Filter	Type	Default	Notes
Date range	Start/end date picker	Last 30 days	Required for entities with timestamps
Status	Multi-select	All statuses	[List available statuses]
Owner/assignee	User picker	Current user	Admins can select any user
Custom fields	Dynamic based on entity	None	Only fields the user has access to

Field Selection.

☐ Users can select which fields to include (column picker)
☐ Default field set covers the most common use case
☐ "Select all" and "deselect all" controls
☐ Field selection is saved per user for repeat exports
☐ Field order in the export matches the selection order

Large Dataset Handling

Threshold	Behavior
< [X] rows	Synchronous download (immediate file response)
[X] to [Y] rows	Async export with in-app notification when ready
> [Y] rows	Async export with email delivery (download link, expires in [Z] hours)

Async Export Flow.

User configures export (entity, filters, format, fields)
System returns a job ID and estimated completion time
Export runs in background queue
On completion: notify user via [in-app notification / email / both]
Download link is valid for [X] hours, then the file is deleted
User can view export history and re-download recent exports

Export Job Status.

Status	Description
Queued	Job accepted, waiting for worker
Processing	Export in progress, [X]% complete
Complete	File ready for download
Failed	Error occurred, retry available
Expired	Download link has expired

Scheduled Exports

Setting	Options
Frequency	Daily / Weekly / Monthly / Custom cron
Delivery Method	Email attachment / Email download link / Webhook / S3 bucket
File Naming	`{entity}_{date}_{format}.{ext}`
Retention	[X] most recent exports retained
Notification	Email on success / Email on failure only / Both

Permissions and Privacy

Access Control.

Role	Can Export Own Data	Can Export Team Data	Can Export All Data	Can Schedule Exports
Member	Yes	No	No	No
Team Admin	Yes	Yes (own team)	No	Yes (own team)
Org Admin	Yes	Yes	Yes	Yes

Field-Level Privacy.

Field	Export Behavior	Rationale
`password_hash`	Never included	Security
`internal_id`	Never included	Internal use only
`email`	Included for admins, redacted for members	PII
`ip_address`	Included in compliance exports only	PII
`deleted_at`	Included with "Include deleted" filter	Soft-deleted records

Compliance.

☐ GDPR Article 20: machine-readable format, delivered within 30 days
☐ CCPA: "Right to Know" export within 45 days
☐ Audit log entry created for every export (who, what, when, row count)
☐ Exports of other users' PII require admin role and are logged separately

API Endpoint (if applicable)

POST /api/v1/exports

Request body:

{
  "entity": "tasks",
  "format": "csv",
  "filters": {
    "date_range": { "start": "2026-01-01", "end": "2026-03-05" },
    "status": ["active", "completed"]
  },
  "fields": ["id", "title", "assignee", "status", "created_at"],
  "delivery": "download"
}

Response (202 Accepted):

{
  "export_id": "exp_8k3m2n",
  "status": "queued",
  "estimated_rows": 12450,
  "estimated_completion": "2026-03-05T10:35:00Z"
}

Open Questions

#	Question	Owner	Status	Decision
1	[Question]	[Name]	Open
2	[Question]	[Name]	Open

Filled Example: Project Management Tool Data Export

Export Feature Overview

Field	Details
Feature Name	TaskFlow Data Export
Author	Jordan Park, PM
Engineering Lead	Alex Rivera
Target Release	Q2 2026
Status	Approved

Summary. TaskFlow users can export tasks, projects, and time entries in CSV, JSON, and XLSX formats. Admins can export team-wide data. Scheduled weekly exports deliver to email or S3 bucket.

Exportable Data Entities

Entity	Fields Included	Default Fields	Max Rows	Permissions
Tasks	24 fields	title, assignee, status, priority, due_date, created_at	2.1M (largest customer)	Member: own tasks. Admin: team tasks.
Projects	15 fields	name, owner, status, start_date, task_count	8,400	Member: own projects. Admin: all.
Time Entries	12 fields	task, user, hours, date, billable	890K	Member: own entries. Admin: team entries.

Large Dataset Handling

Synchronous download for exports under 10,000 rows. Async with in-app notification for 10K-500K rows. Async with email download link (expires in 48 hours) for 500K+ rows. Background workers process exports using streaming writes to avoid memory spikes.

Key Takeaways

Map every exportable entity and field before building the UI
Use async exports with background jobs for datasets over 10K rows
Mirror view permissions in export permissions, but restrict bulk PII export to admins
Always use UTF-8 with BOM for CSV to prevent Excel encoding issues
Log every export for compliance and audit purposes

About This Template

Created by: Tim Adair

Last Updated: 3/5/2026

Version: 1.0.0

License: Free for personal and commercial use

Data Export Specification Template