Offboarding a service provider that holds customer data

Cancelling a subscription does not necessarily stop the flow of customer data. A scheduled export can keep running. A contractor’s account can remain active. A restored backup can bring an old contact list back into use. A useful exit plan therefore follows the data relationship beyond the final invoice.

Start while the provider is still willing and able to help. Decide what your business needs to recover, what must stop, which copies require a lawful retention decision, and how you will check that the exit actually happened.

Put the legal timing beside the plan

The DPDP erasure and accountability provisions discussed here are scheduled to commence on 13 May 2027; they are not all current duties on 22 October 2026. The commencement notification sets that later phase. Existing contractual and other applicable obligations still need attention during the transition.

Once operative, section 8(7) and 8(8) will link erasure to withdrawal or the end of purpose, subject to legal retention, including erasure by processors of data made available to them. The final framework also contains purpose-limited retention provisions, including rule 8(3) and the Seventh Schedule, and security retention under rule 6(1)(e). An exit instruction must account for those provisions rather than promise instant destruction of every copy.

Recover only the records you need

Before cutover, list the records the replacement service or internal team needs. Check the export format, field definitions, attached documents, consent evidence where relevant and links between records. A file that opens successfully can still omit withdrawal status or misalign customer identifiers.

Use a reconciliation sample. Compare several records in the old service with the exported version, including an inactive account, an unusual character in a name and a record with an unresolved issue. Keep the export in a restricted location, assign someone to validate it, and decide when the migration copy will leave active use. Avoid creating a permanent extra database merely because migration was difficult.

Stop the routes that can repopulate the system

List incoming and outgoing integrations separately. Disable scheduled jobs, automatic uploads, shared folders, message forwarding and webhook destinations as appropriate. Record who controls each route. Revoking the provider’s login will not stop a system that continues to send new files to its inbox.

Next, remove user accounts, service credentials, support access and publicly shared links. Rotate a credential if another party has possessed it and it remains in use elsewhere. These are practical security steps; the exact sequence depends on the system and the continuity your customers need.

A hypothetical accounting-service exit

A small wholesaler replaces an outsourced accounts provider. Its first concern is retrieving invoices, but the old provider also has delivery addresses in a shared folder and access to the billing application. The owner exports the necessary financial records, checks a sample against the ledger and disables the shared-folder feed after reconciliation.

The owner then asks the provider to identify what it proposes to retain, for which purpose, under which obligation and for how long. Some professional or statutory records may require a different role and retention analysis from files processed only on the wholesaler’s instructions. The business does not assume that every activity is a processor activity simply because one company issued the invoice.

The final exit record distinguishes returned records, erased working copies, restricted retained material and copies awaiting a defined backup-expiry event. That is more informative than a single tick beside ‘data deleted’.

Ask about backups in operational language

Ask whether backups are routinely searchable, who can restore them, when they expire and what happens if they are restored after the exit. Where a retained backup cannot yet be removed, establish restrictions on reuse and a process to reapply the exit instructions after restoration. Have the responsible team evaluate the legal basis and retention period; convenience alone is not a reason for indefinite storage.

Request evidence proportionate to the relationship. It could include an export reconciliation, access revocation records, a provider confirmation with explicit scope, and a dated explanation of residual copies. A certificate that says ‘all data deleted’ while excluding every backup is useful only if you understand those exclusions.

Test the closure

After the agreed cutoff, attempt a permitted check of the old sharing path, review whether any scheduled transfer still succeeds and confirm that the provider no longer appears in active workflows. Assign unresolved items a named owner and deadline.

The aim is a controlled ending with visible exceptions. If the provider cannot explain where data remains, keep that uncertainty open and escalate it. Closing the commercial account should follow an evidence-backed data decision, not substitute for one.