What happens to customer data when an enterprise contract ends?

Buyers want three things at contract end: a way to get their data back, a stated time by which you delete it, and some proof that deletion happened. Write your answer as a procedure with owners and timelines, and describe backups honestly rather than claiming instant, total erasure.

The questions behind the question

When a questionnaire asks about data return and deletion, the reviewer is checking for lock in and for lingering copies. Expect variations such as:

• Can we export all our data in a usable format?
• How long after termination do you delete it?
• Does deletion cover backups, logs, and copies held by subprocessors?
• Will you confirm deletion in writing?

Your contract, not the questionnaire, is where the commitment lives. Legal terms are for your counsel to set. Your security and operations teams supply the facts that make those terms keepable.

Build the procedure first

Before you write any answer, make sure the steps exist and someone owns them.

1. Export. Define the formats you provide, the scope (records, attachments, configuration) and how the customer requests it.
2. Grace period. State how long data stays available after termination, so customers can retrieve it. Decide who may extend it.
3. Deletion. Identify every place customer data lives: primary stores, search indexes, caches, analytics, object storage, support tools and logs.
4. Backups. Decide when backups age out and say so. Backups are rarely edited record by record, so many vendors describe deletion from backups as expiry on a schedule.
5. Subprocessors. List which ones hold customer data and how deletion is requested from each.
6. Confirmation. Produce a short certificate or email stating what was deleted and when.

What "deleted" means

NIST's media sanitization guidance describes sanitization as rendering access to target data on the media infeasible for a given level of effort, and notes techniques such as crypto erase and secure erase. In a cloud service you rarely control the physical media, so the practical equivalent is logical deletion plus provider guarantees, or deleting the encryption keys for a tenant's data where your design allows it. Describe which approach you use. Do not claim physical destruction if your provider performs it, and do not claim a method you have not built.

A sample answer shape

"On termination, customers can export their data in standard formats for a defined period. After that period we delete production data within a stated number of days. Backups expire on their normal cycle, after which no copy remains. Subprocessors are instructed to delete on the same schedule. We confirm completion in writing on request."

Replace each placeholder with your real numbers. If an item is not true yet, say it is planned, with a date, instead of leaving it out.

Evidence worth keeping

• The written procedure with an owner and a review date.
• A ticket or log from a real deletion, with customer identifiers removed.
• Backup retention settings.
• Your subprocessor list, so the reviewer can see the full set of holders.

The post on subprocessor change notice and objection rights pairs well with this one, since the same list drives both questions.

Test it once

Run a deletion drill on a test tenant. You will almost always find a store nobody listed, such as an analytics table or a log index. Finding it yourself beats a reviewer finding it later.

Safeguard's asset discovery can help you list the systems and services in your environment, which is the first step in knowing where customer data might sit.

Quick check

Sources

• NIST, SP 800-88 Rev. 1, Guidelines for Media Sanitization

Last reviewed: 19 October 2026.