IT vendors and contracts

IT vendor exit plan template: what to agree before you need it

Published 20 October 2026 · 6 min read

An IT vendor exit plan sets out, before you sign, how a service will be handed back to you or transferred to another provider: the scope and timetable of the exit, the inventory of what is transferred, the teams on both sides, knowledge transfer and parallel running, the deletion of your data with a certificate, and the cost of exit assistance. It belongs in the contract or its schedules because that is when you have leverage. Three EU texts already frame parts of it: Article 28(3)(g) of the GDPR for personal data, Articles 25 and 29 of the Data Act for switching cloud and other data processing services, and Articles 28(8) and 30(3)(f) of DORA for financial entities.

Why exit is negotiated at signature

At signature, the vendor wants the contract and you can still choose another bidder. At exit, the vendor is losing the account, holds the documentation and the access, and every hour of assistance becomes a negotiation. Lock-in is rarely a single clause: it is data that cannot be exported without fees, configurations nobody else has seen, licences or domain names held in the vendor's name. An exit plan agreed at the start, even as an outline, turns those surprises into checked items.

The legal floor depends on the service. Under Article 28(3)(g) of Regulation (EU) 2016/679 (GDPR), the contract with a processor must stipulate that the processor, at the choice of the controller, deletes or returns all the personal data at the end of the services and deletes existing copies, unless Union or Member State law requires storage. For financial entities, Regulation (EU) 2022/2554 (DORA), applicable since 17 January 2025, requires exit strategies for ICT services supporting critical or important functions, with exit plans that are "comprehensive, documented" and "sufficiently tested and reviewed periodically" (Article 28(8)), and contracts that provide a mandatory adequate transition period (Article 30(3)(f)).

The six sections of an exit plan

Section	Content	Question to ask the vendor
1. Scope and timetable	Triggers (expiry, termination), notice, milestones, actual end date	What do you need from us, and when, to finish on the end date?
2. Inventory transferred	Data, documents, configurations, source code, hardware, licences, domains, certificates	Which items are in your name today, and how are they transferred?
3. Teams and responsibilities	Named roles on both sides, the incoming provider's role, escalation	Who leads the exit on your side, and with what availability?
4. Knowledge transfer	Sessions, operating procedures, parallel running period	How many sessions, with whom, and how long can both run in parallel?
5. Deletion and certificate	Data, backups, access, time limits, certificate of deletion	When are backups deleted, and who signs the certificate?
6. Costs	Exit assistance (duration and rate), one-off fees, credits still due, final invoice	What exactly is included in the fee, and what is billed on top?

Duration, costs, obligations

Write three things into the contract rather than the plan: the duration of exit assistance, its price or rate, and the vendor's obligation to keep delivering the service at the contractual level during the transition. Ask your lawyer whether assistance is also due when the contract ends for your breach, and how fees change if you terminate early.

For data processing services such as cloud, the Data Act (Regulation (EU) 2023/2854, applicable since 12 September 2025) sets contractual minimums in Article 25: a maximum notice period of two months to start switching, a mandatory maximum transitional period of 30 calendar days during which the provider assists and maintains continuity (an alternative period of up to seven months only if the provider justifies technical unfeasibility within 14 working days, and a right for the customer to extend once), a data retrieval period of at least 30 calendar days, and full erasure afterwards. Under Article 29, providers may charge only reduced switching charges, not exceeding their direct costs, until 12 January 2027, and no switching charges from that date. Article 31 excludes some services, such as custom-built ones, from part of these rules, and test versions from all of them. These figures come from the text as published in the Official Journal; check the consolidated version before relying on them.

Data: formats, deadlines, deletion

Formats: name them (open, documented, with the data structure), not "a standard format". The Data Act requires providers to give an exhaustive specification of exportable data and a reference to an online register of data structures and formats (Articles 25(2)(e) and 26).
Deadlines: date of the full export, date of the final delta export, retrieval period after the end of the service.
Integrity: who checks volumes and completeness, and how a defective export is redone.
Deletion: data, backups and logs, with the time limit and a certificate; for personal data, the controller's choice under GDPR Article 28(3)(g).

Testing exit readiness

An exit plan that has never been rehearsed is likely to be out of date on the day you need it. Eight checkpoints give a quick readiness view per contract:

Data exportable in an open format, tested by an actual export you opened.
Documentation current and held by you.
Licences, domains, certificates and subscriptions in your company's name.
Administrator accounts under your control, the vendor's revocable.
Exit plan written and reread in a review.
Exit clause covering duration, cost and assistance.
In-house skills or an identified alternative provider.
A recent copy of the data held outside the vendor.

Answer Yes, Partial or No, and deal with the "No" answers on critical contracts before the renewal decision, when the exit plan is part of your negotiating position. Supplier relationships are also a NIS 2 topic for entities in scope, under Article 21(2)(d) of Directive (EU) 2022/2555: see the NIS 2 compliance checklist.

Template (structure)

A one-page header, then the six sections above: contract reference and parties; service scope and criticality; exit triggers; version and date of last review; owner on each side. Keep the plan with the contract, record in your register that it exists and when it was last reviewed, and link it from the contract's row in the IT contract register.

What the tool does for you

The IT Vendor and Contract Management Kit is a nine-sheet Excel workbook with native formulas and no macros, for Excel 2016 and later or Google Sheets. Its Exit readiness sheet takes, per contract read from the register, eight Yes, Partial or No answers (data, documentation, licences, access, exit plan, exit clause, skills, data copy) and the date of the last exit plan review, then computes a readiness score, a level (Ready from 75%, At risk below 50%, Partial in between, as set in Settings) and a P1 to P3 priority that combines the score with the contract's criticality; the score flows back into the contract register, whose alerts include "Prepare exit". The Word templates include an exit plan outline in six sections and a notice of non-renewal or termination letter that requests the exit plan. The 22-page guide covers preparing the exit from day one and ten clauses to review with the question to ask your lawyer. Fictitious data set, unlimited use within the licensed company, 12 months of updates.

IT Vendor and Contract Management Kit: $290 excl. tax

Launch code LANCEMENT: 30% off, for the first 20 orders or until 30 November 2026.

FAQ

Does the GDPR require an exit plan?

Not by that name. Article 28(3)(g) requires the processor contract to provide for the deletion or return of personal data at the end of the services, at the controller's choice; the exit plan is where you organise how and when.

How long should exit assistance last?

There is no general figure. For switching data processing services, the Data Act sets a maximum transitional period of 30 calendar days, with the exceptions in Article 25; for other services, agree a duration based on the transfer you have rehearsed.

When should the plan be reviewed?

Whenever the service changes, and before each renewal decision. Financial entities under DORA must test and review exit plans periodically; for other organisations, a yearly review of critical contracts is a sensible habit.