Vendor offboarding checklist: data return, deletion and access

To offboard a vendor safely, export your data, revoke every account and integration, rotate any shared secrets, get written confirmation of deletion, and update your inventory and records. Start before the contract ends, because you lose leverage and access at the same time.

Why it gets missed

Onboarding has a process. Offboarding often does not. Cancelled tools keep API tokens, shared mailboxes and copies of your data for years. Each is a standing risk with no owner.

Before the end date

1. Read the contract. Find the data return and deletion terms and the notice period. Under GDPR Article 28(3)(g), a processor's contract must provide that, at the controller's choice, it deletes or returns all personal data after the services end and deletes existing copies unless law requires storage.
2. Decide: return or delete. Often both: export first, then delete.
3. Plan the replacement. Do not cut access before the new system works.

Data

• Request an export in a usable format and check it opens and is complete.
• Confirm what the vendor keeps in backups and for how long.
• Ask for deletion in writing, with a date and what was deleted.
• Ask whether subprocessors hold copies, and that deletion extends to them.
• Keep the export under your own retention rules.

Access

1. Remove user accounts and single sign-on connections.
2. Revoke API keys, OAuth grants and webhooks you created.
3. Remove the vendor's access into your own systems: VPN, shared drives, source repositories, cloud roles.
4. Rotate any secret the vendor ever saw, even if you think it is unused.
5. Remove allowlist entries and firewall rules.

Integrations and software

Check code, build files and infrastructure templates for references to the vendor: SDKs, scripts, tracking tags, DNS records. A dependency scan can show libraries still pulled in. Safeguard's SBOM and dependency scanning can list those, and a free scan is at https://gold.safeguard.sh/scan.

Records

• Mark the vendor as offboarded in the inventory with the date.
• Store the deletion confirmation with the vendor file.
• Update your own subprocessor list if the vendor was on it.
• Cancel payment and expense lines, which also closes the shadow billing gap.
• Tell the team the tool is gone so nobody re-signs up.

After the date

Set a reminder thirty to ninety days later. Check that logins fail, data requests return nothing, and no invoices arrive. Ask for a second deletion confirmation if backups were due to expire in that period.

Quick check

Sources

• GDPR Article 28

Last reviewed: 19 October 2026.