Getting Your Data Out When You Cancel a SaaS Contract

Who owns the data

Most business SaaS contracts say the customer owns its data and the vendor has a licence to use it to provide the service. Ownership does not guarantee easy access after termination, though. Check both ownership and the practical export terms. Our guide on who owns your data in a SaaS agreement covers ownership in depth.

Export rights

Data that cannot be exported in a usable format is hard to move to another system.

• Can you export all data, or only certain types?
• In what formats: CSV, JSON, database dumps, original files?
• Is export self-service, or must you request it?
• Are attachments, metadata, audit logs and history included?
• Is there a fee for export or assistance?

Post-termination access

Many contracts give a set period after termination, such as 30 days, to export data, sometimes in read-only mode. Others end access immediately. If the contract is silent, ask the vendor in writing before termination what access you will have.

Deletion

Contracts often say the vendor will delete your data within a period after termination, such as 30 to 90 days, with exceptions for backups and legal requirements. Ask for written confirmation of deletion when complete, especially if the data includes personal information. Data processing addendums commonly include return and deletion obligations.

How do you plan a SaaS exit?

• List the data you need and where it lives in the system.
• Test an export before giving notice.
• Check the new system's import requirements.
• Schedule the export before the termination date.
• Verify the exported data is complete.
• Keep copies in secure storage.
• Request deletion confirmation.

What happens to your data if the SaaS vendor shuts down?

If the vendor goes out of business, is acquired or ends a product, data access can be at risk. Contracts may include transition assistance obligations, or source code or data escrow for critical systems. For important systems, negotiate transition assistance at signing: a period of continued access and help moving data at reasonable rates.

A worked example

A small agency cancels its project management tool. The contract allows 14 days of read-only access after termination and exports only task lists as CSV, not attachments. The agency discovers this on day 10 and cannot download thousands of files in time. Had it tested exports before cancelling and negotiated a 60-day window, it would have kept its archives.

Sample email to the vendor

"We plan to end our subscription on [date]. Please confirm: the period during which we can access and export our data after termination, the formats available, whether attachments and history are included, any fees, and when our data will be deleted. Please also confirm you will provide written confirmation of deletion."

Common mistakes

• Giving notice before testing exports.
• Assuming attachments and history are included.
• Missing the post-termination export window.
• Forgetting about integrations and backups.
• Not requesting deletion confirmation.

Quick checklist

• Does the contract confirm you own your data?
• What export rights and formats apply?
• How long is post-termination access?
• When will data be deleted?
• Are there export fees?
• Is transition assistance available?

Key terms explained

These terms decide how you leave a platform.

• Data export: downloading your data from the system.
• Post-termination access: time to access data after the contract ends.
• Transition assistance: vendor help to move data to another provider.
• Data escrow: a third party holding data to release in defined events.
• Deletion certificate: written confirmation that data has been deleted.

What about data held in integrations and connected apps?

Your data may not all live in one place. Integrations, automations and connected apps may store copies, sync data to other tools or rely on the platform to work. Before cancelling, list integrations and decide which to migrate, which to switch off and which hold data you need. Revoke API keys and access tokens after migration so old connections cannot continue sending data.

Records you must keep

Some data must be kept for legal, tax or regulatory reasons, such as financial records, employment records or audit logs. If the vendor's system is your only copy, export and store it securely in a format you can read later. Consider whether you need to keep it in a system that preserves its integrity and dates, such as a document management system.

Personal data and deletion rights

If you hold personal data about customers or employees, privacy laws and your own policies may require deletion when it is no longer needed. Coordinate the export and deletion so you keep only what you need. Get the vendor's deletion confirmation and keep it in your records.

Do any laws give you a right to get your data back?

In the US, generally no statute gives a business customer a right to export its data from a SaaS vendor. The contract controls, which is why the export, access and deletion terms covered here matter so much. Privacy laws focus on personal data rather than your business records as a whole.

Where European personal data is involved, the GDPR helps. Article 28(3)(g) requires a processor, at the controller's choice, to delete or return all personal data when the services end, and to delete existing copies unless law requires them to be kept. If you are subject to the GDPR, your data processing addendum should include this, and it gives you a clear basis to ask for a full return before deletion.

The EU has also gone further for cloud services. The EU Data Act, Regulation (EU) 2023/2854, gives customers of data processing services, including SaaS, switching rights. Contracts must let customers start a switch with a maximum notice period of two months, followed by a transition period normally capped at 30 days, extendable to up to seven months where that is not technically feasible. Charges for switching are limited to direct costs and are due to be abolished from 12 January 2027. These rules apply to services provided to customers in the EU.

For US-only businesses, these laws are useful benchmarks. A two-month notice period, a 30-day transition window and free export are reasonable things to ask for when you negotiate exit terms at signing. Whatever you agree, write the export format, the length of the access window, any fees and the deletion certificate into the contract itself, rather than relying on a help center page that the vendor can change at any time.

Migration to a new vendor

Many vendors offer migration help for customers switching to them. Ask your new provider which export formats it accepts and whether it has tools or services to import data from your old system. Run a pilot import with a sample of data before the full migration, and check that relationships between records, such as customers and their invoices, survive the move.

Negotiating exit terms at signing

When signing a new SaaS agreement, ask for: at least 60 days of post-termination access, exports in standard formats including attachments and history, no export fees, reasonable transition assistance and written deletion certification. These terms cost vendors little and save you significant risk.

Check backups and archives

Ask whether the vendor keeps backups after deletion and for how long, and whether backup data remains protected by the contract's confidentiality terms until it is overwritten. Most contracts allow backups to expire on their normal cycle.

A second example: the vendor shuts down

A retailer relies on a small inventory tool. The vendor announces it is closing in 30 days. The contract has no transition assistance clause and exports only current stock levels, not historical sales data. The retailer spends two weeks building manual workarounds and loses three years of sales history useful for forecasting. A clause requiring 90 days' notice of discontinuation, full exports including history and reasonable transition help would have made the closure an inconvenience rather than a loss. For smaller or early-stage vendors, these clauses matter even more, because the risk of a shutdown or acquisition is higher.

Test exports regularly

Do not wait until you leave. Test a full export once or twice a year, check that it opens and is complete, and store a copy. Regular exports double as a backup if the vendor has an outage.

Who should own the exit

Assign one person to own the exit: listing data, testing exports, coordinating with the new vendor, confirming completeness and requesting deletion. Exits fail most often when everyone assumes someone else downloaded the files. A named owner with a checklist and a deadline a week before access ends prevents that.

Check exit terms at signing

Data exit terms are easy to add before signing and hard to fix later. Upload a SaaS agreement to see its data ownership, export, deletion and transition terms explained.