Contract clause
Data return and deletion clause
A data return and deletion clause decides what happens to customer data when a service ends. It gives the customer a window to export its data in a usable format, then requires the supplier to delete every copy, including backups, by a set date, and to confirm in writing that it has done so.
Leaving a software platform is when customers discover whether their records can come with them. The clause is written at the start of the relationship because at the end the supplier has no reason to be quick or generous.
Indunil Asanka · Co-founder
4 min read · Published
Sample clause
a subscription agreement between Tarrawonga Cloud, a fictional practice management platform, and Brightwater Vets, a three clinic veterinary group in Bunbury
16. Customer Data at the End of the Agreement 16.1 For 30 days after this agreement ends, Tarrawonga Cloud must keep Brightwater Vets' access to the export function and must provide, on request, a complete export of Customer Data in CSV format together with attached files in their original format. 16.2 Tarrawonga Cloud must not charge for the first complete export. Further exports are charged at the rate in Schedule 2. 16.3 Within 90 days after this agreement ends, Tarrawonga Cloud must permanently delete all Customer Data from its production systems and backups, and must ensure its subcontractors do the same. 16.4 Clause 16.3 does not apply to Customer Data that Tarrawonga Cloud is required by law to retain. That data must remain subject to clause 9 for as long as it is held, and must be deleted as soon as the requirement ends. 16.5 Within 10 business days of a written request, Tarrawonga Cloud must give Brightwater Vets a certificate signed by an authorised officer confirming the deletion.
Sample wording, not legal advice.
Variants
Export then delete
The customer is moving to another provider and needs a clean handover before anything is destroyed.
Before deleting any Customer Data, the Supplier must give the Customer written notice that the export window is closing at least 10 business days before it closes. The Supplier must not delete Customer Data until the Customer confirms in writing that it has received a complete and readable export, or until 45 days after this agreement ends, whichever is earlier. The Supplier must then delete the data within 60 days.
Delete only
The supplier processed a copy of data the customer already holds, such as a mailing or analysis job.
The Contractor does not hold the only copy of any Customer Data. Within 14 days after completing the Services, the Contractor must securely delete all Customer Data from every system and device it used, including working files and email attachments, and must confirm by email that it has done so. The Contractor must not keep any Customer Data for testing, training or reference.
Retention for legal holds
Records may be needed for an investigation, dispute or regulator request after the contract ends.
If the Customer notifies the Supplier before deletion that particular Customer Data is subject to a legal hold, the Supplier must preserve that data in a secure, access controlled location until the Customer tells the Supplier in writing that the hold has ended. The Supplier may charge its reasonable storage costs. All other Customer Data must be deleted in accordance with this clause.
What to negotiate
Format of the export
A customer that receives thousands of PDFs instead of structured data has technically been given its records and practically lost them. Customers ask for a named machine readable format and attachments in their original form. Suppliers resist bespoke formats, so the usual agreement is the platform's standard export, described in the clause, free the first time.
Backups
Backups are the hardest part to delete, because many systems keep rolling copies that expire on a schedule rather than on demand. Suppliers ask to let backups age out. Customers accept a longer backup window, often 90 days, provided the data in backups is not restored or used and stays protected until it expires.
Proof of deletion
A deletion certificate is a statement, not a technical guarantee, so its value lies in who signs it and what it covers. Customers ask for a signed certificate naming the systems, the subcontractors and the backup position. Suppliers prefer a standard form letter. Agreeing the content of the certificate in a schedule avoids a debate at the end.
The risk of leaving it out
Without the clause a departing customer may find its export is incomplete, paid, or unavailable after the account closes, and the supplier may keep its data indefinitely. For a business covered by the Privacy Act, information still held by a former supplier is information it can no longer control.
The four steps, in order
The clause works best as a timeline. First, the export window: a fixed number of days after termination during which the customer keeps access or can request a full export. Second, the handover check: the customer confirms the export is complete and readable. Third, deletion: the supplier removes the data from live systems and from backups, and makes its subcontractors do the same, by a stated date. Fourth, confirmation: a certificate signed by someone accountable. Each step needs its own deadline, because a single sentence saying the supplier will return or delete the data on termination gives neither party a date to work to.
Deletion and the duty to keep records
APP 11 requires an entity covered by the Privacy Act to take reasonable steps to destroy or de-identify personal information it no longer needs, unless the law requires it to be kept. Article 28 of the UK GDPR similarly requires a processor to delete or return data at the end of the services unless law requires storage. Retention duties run the other way. The ATO expects most business records to be kept for 5 years, so a customer whose only copy of its invoices sits on a supplier's platform needs that copy back before anything is destroyed. That is why the sample puts the export before deletion and carves out legally required retention.
Where it sits in a generated document
The clause usually appears near the end of a generated subscription agreement, after termination and before the general provisions. Documents carry no input fields, so the export format, the day counts and the certificate are best named in the description so the draft carries the real values. The generated text prints no citations, so each period and any reference to record keeping law is worth checking before signing.
Documents that carry this clause
UK data processing agreement template with sub-processorsA data processing agreement is what a UK controller has to have in writing before a processor touches personal data. This one covers a hosted order management platform for a UK retailer, with the processing annex, a table of five named sub-processors and their transfer safeguards, eight security measures, and a breach notice of 48 hours rather than 72.
IT support services agreement with response times by priorityManaged support is sold on a monthly fee and judged on how fast the phone gets answered when nobody can work. This agreement grades every ticket into four priorities with a published response and resolution target, credits the fee when the target is missed, and writes down exactly what the provider hands back on the way out.
Software licence agreement template with seats, term and supportA software licence agreement has to answer three questions before anything else: what a seat is, what happens when the software is down, and who gets the data at the end. This one licenses a hosted practice management suite to a medical practice for 25 named users at $9,600 a year, with a support table, uptime credits and a 30 day export.
Service agreementBeacon Systems supports Harlow Freight’s IT for an initial 24 months from 1 October 2026 at $8,400 a month plus GST, with 40 hours included and $220 an hour beyond them. Twelve numbered clauses cover the services, a four level severity table, client duties, fees with a CPI adjustment, confidentiality, privacy, IP, a liability cap, termination and a three step dispute ladder.Questions people ask
How long should a customer have to export its data?
Thirty days is a common export window for software services, with 60 or 90 days for complex platforms where migration takes longer. The window should start when the agreement ends, not when notice is given, and the supplier should keep the export function working throughout. A notice before the window closes prevents avoidable losses.
Can a supplier charge for returning data?
The contract decides. Many clauses make the first complete standard export free and charge for additional exports, custom formats or migration help. Customers should resist any fee for simply receiving their own data in the platform's normal format, since a high charge at exit works as a penalty for leaving.
Does deleted data include backups?
It should, but the timing is usually different. Backup systems often keep copies for a set rotation period and cannot delete one customer's records on demand. Clauses commonly allow backups to expire within a stated period, such as 90 days, provided the data is not restored, accessed or used in the meantime.
What is a certificate of deletion?
A written statement from the supplier, signed by an authorised person, confirming that customer data has been deleted from named systems, backups and subcontractors by a date. It does not prove deletion technically, but it creates a clear record and makes a false statement a serious matter. The clause should say what the certificate covers.
What if the supplier must keep some records by law?
The clause should carve out data the supplier is legally required to retain, keep it subject to the confidentiality and security terms for as long as it is held, and require deletion once the requirement ends. The carve out should be limited to the specific records, not used as a general reason to keep everything.
How is this different from returning confidential materials?
A return of materials clause covers documents and information exchanged between the parties, often with a destroy or return choice and an archival copy exception. A data return and deletion clause deals with systems holding the customer's records, so it focuses on export formats, access windows, backups and subcontractors. Many agreements need both, drafted so they do not conflict.
Put the clause in a finished document
The button opens the document generator with a starting description already filled in. Change it to match your own agreement before you run it.
Create a document with OneCraftRelated clauses
- Data processing clause under UK GDPR Article 28A UK data processing clause gives the controller to processor terms UK GDPR Article 28 requires. Sample for a marketing agency, the mandatory points, variants.
- Records clause: what to keep and for how longA records clause sets what a party must record under a contract and how long it keeps it. Australian sample with a 7 year period, statutory minimums, variants.
- Return of confidential information clauseA return of confidential information clause says what is given back or destroyed at the end. Sample wording, backup carve outs and the destruction certificate.
- Transition assistance clauseA transition assistance clause sets the help an outgoing supplier must give at exit. Sample wording, free and paid variants, data formats and what to negotiate.
For everything the document generator can do, see the document maker.
Step by step in the builder: Create a document with AI, then Document builder components.
Written and checked by the OneCraft team. Last checked .