Businesses often say that they “own the data”, but a successful exit depends on more specific rights and capabilities: what can be exported, in which format, with which history, at what time and for what cost.
Contractual rights, data-protection duties and technical export capability are related but not identical. Review the actual service agreement and obtain specialist advice where the position is important or disputed.
Define the data required for continuity
Create an inventory covering:
- primary business records;
- relationships and stable identifiers;
- documents, images and attachments;
- comments, notes and communication history;
- audit logs and status history;
- configuration and custom fields;
- user, role and permission information;
- reference data and lookup values;
- archived or inactive records;
- evidence required for legal or regulatory purposes.
Distinguish different rights
| Right or obligation | What it addresses |
|---|---|
| Contractual data return | What the supplier must provide to the customer on request or exit. |
| Technical export capability | Whether the platform can produce a complete and usable extract. |
| Data-protection controller duties | How personal data is controlled, retained, returned or deleted. |
| Individual data portability | A specific right applying in defined circumstances to personal data concerning an individual; it is not a general business database export right. |
| Intellectual-property or database rights | Rights affecting software, structures, compiled data or third-party content. |
Specify format and completeness
“Machine-readable export” is too vague for an operational contract. Define:
- file formats and character encoding;
- data dictionary and schema;
- stable keys and relationship mapping;
- attachment packaging;
- date, time-zone and numeric conventions;
- incremental and final export arrangements;
- encryption and secure transfer;
- volume and performance constraints.
Test exports before the exit
Obtain representative extracts during normal operation. Validate:
- record counts and totals;
- required fields and null values;
- relationships between records;
- attachments and metadata;
- history and audit evidence;
- the ability to import into a neutral test database or target platform.
A successful download does not prove that the data is usable.
Address changes during migration
Data continues to change between the first export and cutover. Agree:
- migration freeze or controlled change window;
- incremental export of new and changed records;
- handling of deletions and status changes;
- final reconciliation;
- which system is authoritative at each stage.
Clarify charges and assistance
Some suppliers include standard exports but charge for custom extracts, media, consultancy or high-volume transfer. Record these costs before exit. Also define reasonable assistance for explaining schema, resolving failed exports and confirming deletion.
Protect data during transfer
Use approved secure transfer, named recipients and access controls. Avoid sending large extracts through ordinary email or placing them in unmanaged personal storage. Record who received the data, when, and how temporary copies will be removed.
Plan retention and deletion
After successful migration, decide what remains with the old vendor, what must be deleted and what may be retained lawfully. Where the vendor processes personal data on behalf of the organisation, the contract should address return or deletion at the end of services, subject to applicable legal requirements.
Keep evidence of the request and completion, but do not claim certainty that every technical backup disappears immediately without understanding the provider's documented retention process.
Supplier questions
- Can we obtain a full sample export now?
- Which data types and histories are excluded from the standard export?
- How are relationships, attachments and custom fields represented?
- How are changes captured between test migration and cutover?
- What support and charges apply during exit?
- How and when will remaining data be returned or deleted?
Validate difficult records
Choose ten representative records, including complex and historical cases, and trace every field, relationship, document and audit event through a sample export. Use the missing elements to define the contractual and technical export specification.