When a security tool contract ends, you want your data back or gone, on a date, with proof. GDPR Article 28(3)(g) says the processor must, at the controller's choice, delete or return all personal data after the services end, and delete existing copies unless law requires storage. Write the clause so it can be checked.
What the article says
Under Article 28(3)(g), the contract must require the processor to delete or return personal data at your choice once the services finish, and to delete existing copies unless EU or Member State law requires storage. The choice belongs to you, so a clause that gives the vendor the choice is weaker than the law expects.
Make the clause specific
A vague line like "data will be deleted on termination" leaves four questions open. Settle them in writing:
What counts as your data? Name it: repository metadata, scan results, findings history, configuration, user accounts, audit logs, uploaded files.
How do you get it back? Ask for a machine readable export, such as JSON or CSV for findings and standard formats for software bills of materials. Confirm the export is available before the term ends, not after.
When is it deleted? Give a number of days from termination. Thirty days is a common ask, but pick what suits you and ask what the vendor can actually meet.
What about backups? Backups often hold copies for a while. Ask how long and whether those copies are overwritten on a schedule. Do not assume immediate deletion.
Ask for confirmation
Request written confirmation that deletion is complete, with the date. Some vendors provide a certificate or an email from a named role. Keep it with the contract record. It is the document you will want if someone later asks where the data went.
What may be kept
Law can require some records to be kept, such as invoices. Ask the vendor to list anything it will retain, why, and for how long. Data kept on that basis should be limited to what the law needs.
Your own end of contract tasks
- Export what you want before notice takes effect.
- Revoke tokens and app installs on the source control side.
- Remove the tool from CI so builds do not fail on a missing service.
- Rotate any secret you stored in the tool.
- Ask for deletion in writing on the termination date.
See the exit plan guide for the findings and rules export side, and vendor offboarding for the access removal list.
Sources
Quick check
Who chooses between delete and return?
Under Article 28(3)(g), the controller does.
Is deleting from the live system enough?
Not on its own. Ask about backups, logs and copies held by subprocessors.
Last reviewed: 19 October 2026.
