Contracts end. The agency loses the account, the platform gets replaced, the bureau gets undercut. The commercial offboarding is usually tidy: final invoice, handover notes, access to the new supplier. The data offboarding is usually nothing. The old supplier still holds your client records, and nobody’s job description says otherwise.
Why it matters
POPIA keeps you accountable for personal information you handed to a supplier, even after the relationship ends. If the former supplier is breached two years later and your client records are in the dump, the exposure is yours. The retention rules also still apply: information may only be kept while there is a purpose for keeping it, and a terminated contract is the clearest possible end of purpose.
The offboarding checklist
- Get your data back in a usable format before access is cut, because exports are hard to negotiate after the last invoice.
- Instruct deletion in writing, covering live systems and backups, and ask when backup cycles will complete.
- Get written confirmation of destruction. A one-line certificate from the supplier is enough; a verbal assurance is not evidence.
- Revoke everything that still works: user accounts, API keys, VPN profiles, shared folders, and any integration that pushed data to the supplier automatically.
- Update your supplier inventory so the vendor no longer appears as a live operator.
Write it into the contract at the start
The time to secure a return-or-destroy obligation is at signature, when the supplier wants the deal. The clause should name the format of the returned data, the deadline for destruction, and the confirmation you will receive. Suppliers rarely refuse it. They simply never offer it, so contracts without the clause are the default rather than the exception.
Replacing a supplier and unsure what they still hold? Tell us what’s on fire