Read also: The store went bankrupt — the supplier kept the data
Most businesses switch systems periodically. HR, payroll, time tracking, CRM. Each time, data remains with the previous vendor.
The question is rarely whether the data exists. The question is whether you get it back. And whether the old vendor deletes their copy afterward.
Data Processing Agreement will regulate exactly this — what happens upon termination. Will you receive the data in a readable format? Does the vendor delete their copy within an agreed timeframe? Have you tested that it actually works?
What does this mean to you?
Check your data processor agreement – does it state what happens to the data when the agreement terminates? If not, add it now.
Inspired by: The Norwegian Data Protection Authority