Data export

Problem Context

• The exported data may include personal information, activity history, files, messages, contacts, billing records, audit records, workspace content, settings, generated outputs, or organization archives.
• Exports may be requested by account holders, admins, compliance staff, support agents, organization owners, or migration operators.
• The export may be synchronous for small tables, asynchronous for archives, category-scoped for privacy dashboards, destination-based for cloud archives, or API-driven for enterprise tools.
• Data may be unavailable because of retention, permission, product support, legal hold, deleted objects, redaction policy, processing delay, or format limits.

Selection Rules

• Choose data export when the user needs a copy or transfer of existing data outside the current product workflow.
• Use bulk import when the task is bringing structured records into the product, including mapping and validation, rather than taking data out.
• Use audit log when the primary task is governed event evidence; data export may package audit records but does not replace audit-log review.
• Use table or data grid export for local row downloads when the scope is one visible dataset; use data export when the workflow needs account, workspace, category, privacy, retention, or package handling.
• Use sensitive-data reveal when the task is briefly exposing one protected value, not preparing a portable archive.
• Require identity, permission, or approval checks when export contains sensitive personal data, organization data, financial data, private files, or another user's records.
• Show data categories, date range, services, account, workspace, format, destination, estimated size, and expected preparation time before starting export.
• State whether export includes deleted, archived, redacted, unavailable, retained, encrypted, or third-party data.
• Provide a manifest, checksum, package ID, or export reference when users need to verify what was produced.
• Keep export distinct from delete account, privacy setting changes, consent withdrawal, notification preferences, and migration import actions.

Required States

• Eligible data categories and unavailable categories state.
• Category selection, date range, account, workspace, format, and destination state.
• Identity verification, permission check, approval required, or policy blocked state.
• Export requested, queued, preparing, estimating size, compressing, and packaging states.
• Large export background job with progress, expected wait, and notification route.
• Partial export with omitted records, redacted fields, failed categories, and retry actions.
• Export ready with package ID, expiry time, size, format, checksum or manifest, and download action.
• Secure download, transfer to another service, copy link, expired link, and regenerate link states.
• Export failed, canceled, rate limited, storage full, unsupported format, and recovery states.
• Post-download state that explains export does not delete source data and records completion where appropriate.

Interaction Contract

• Export scope is explicit before the job starts and remains visible through progress, completion, failure, and download.
• The product does not imply that export removes, deletes, imports, transfers, or anonymizes source data unless that separate action is actually happening.
• Start export records selected categories, filters, format, destination, requester, account or workspace, and timestamp.
• Long-running exports can be left and resumed from a status page, notification, email, or job history without losing context.
• Ready packages show expiry, size, format, checksum or manifest, sensitive-data warning, and the account or destination that can download them.
• Partial or failed exports name affected categories and provide retry, regenerate, support, or archive-request paths.
• Export links, API tokens, and package URLs are time-limited, permission-checked, and do not expose data to the wrong account.
• After download or transfer, the UI states whether the package was downloaded, transferred, expired, canceled, or still available.

Implementation Checklist

• Model export jobs with request ID, requester, account/workspace, category set, filters, date range, format, destination, status, package ID, expiry, manifest, checksum, and error details.
• Classify export data by sensitivity, portability eligibility, file size, product support, retention, legal hold, redaction, and permission requirements.
• Add identity verification, role check, approval, or policy gates for sensitive, admin, organization, or cross-user exports.
• Provide progress for queued, preparing, packaging, ready, partial, failed, canceled, expired, and regenerated-link states.
• Generate a manifest that names included categories, omitted categories, redacted fields, unavailable products, file counts, record counts, format, and timestamps.
• Make download links short-lived and account-bound; support link regeneration and clear expired-link recovery.
• Test large archives, many categories, slow packaging, failed category, partial result, expired link, wrong account, mobile download handoff, storage limits, and screen-reader progress updates.
• Log export requests and downloads without logging raw exported contents in unrelated telemetry.

Common Generated-UI Mistakes

• Using one Export all button with no scope, format, account, destination, date range, or size estimate.
• Confusing export with delete account, privacy preference changes, migration import, or audit-log investigation.
• Leaving sensitive export archives available forever or downloadable by any signed-in user with the link.
• Claiming the export is complete when categories failed, were redacted, or were outside retention.
• Exporting only visible table rows while labelling the result as full account data.
• Putting raw secrets, tokens, private files, or AI prompts into export manifests where broad admins can see them.
• Failing silently after a long-running export job expires or hits an archive size limit.

Critique Questions

• What exact data categories, services, date range, account, workspace, and format are included?
• Which data is not eligible, redacted, delayed, deleted, archived, outside retention, or permission-limited?
• What identity, role, approval, or policy check protects the export?
• How does the user verify the package contents: manifest, checksum, file count, record count, or package ID?
• How long is the package available, who can download it, and how can an expired link be regenerated?
• Does the interface clearly say that exporting data does not delete, import, or transfer source data unless a separate action occurs?