Data Export Specification Template

Use an async job queue. Return a 202 Accepted response with a job ID immediately. Process the export in a background worker that streams rows to a file rather than loading everything into memory. Notify the user via in-app notification or email when the file is ready. Include a progress indicator if the export page is still open. The [glossary entry on asynchronous processing](/glossary/prioritization) covers the underlying pattern.

Yes, if the user has legitimate read access (e.g., a team member viewing shared project tasks), they should be able to export what they can see. The export permission model should mirror the view permission model. The exception is PII fields: even if a team member can see a colleague's email in the UI, bulk export of those emails should require admin-level access and generate an audit log entry. See the [Permissions Specification Template](/templates/permissions-spec-template) for structuring role-based access.

UTF-8 with a byte order mark (BOM). The BOM is a 3-byte prefix that tells Excel to interpret the file as UTF-8 instead of its default encoding. Without the BOM, Excel on Windows garbles non-ASCII characters (accented names, CJK text, emoji). Google Sheets and most BI tools handle UTF-8 with or without BOM correctly.

GDPR Article 20 requires data portability in a "structured, commonly used and machine-readable format." CSV and JSON both qualify. The export must include all personal data you hold about the requesting individual. Deliver within 30 days (though faster is expected). Log every GDPR export request separately from regular exports. Strip data belonging to other users from the export even if the requesting user has admin access. The [PRD Template](/templates/prd-template) includes a compliance section where you can document these requirements. ---