A data subject has the right to access their _personally identifiable information_ (PII) data and have it updated.

You should automate updates, letting the data subject update personal data from your website. You should also be able to process a _subject access request_ (SAR) if the data subject emails or calls you for his or her PII data.

The _right to data portability_ states that a data subject has the right to receive their PII data in some data format that lets them move their data from one data controller to another. GDPR does not state what format this has to be in, but you should keep it simple and in some widely-used format, such as comma-separated values (CSV).