How to assess data export and exit provisions for SaaS Subscription Agreements

Assess SaaS exit provisions by tracing what the customer can retrieve, when access ends, how migration works, what assistance costs, and when deletion occurs. Review the operative contract package, then test its commitments against a representative export with technical owners. Record source-backed findings in an exit checklist, separating contractual rights from observed capabilities and unresolved assumptions. The deliverable is a customer-side decision record identifying required amendments, acceptable fallbacks, evidence gaps, and named approvals for remaining operational risks.

When to use this workflow

Use this review before signing or renewing a subscription, accepting revised product terms, or approving a planned migration. Customer counsel should work with procurement, privacy, information security, and application owners. The question is whether the customer can leave with usable data—not simply whether it owns the data.

This is a U.S.-oriented commercial review, with legal sources assessed as of October 13, 2026. Contract rights depend on actual language, governing law, service configuration, and facts. Assess California privacy coverage and any EU switching-law overlay separately; neither applies automatically to every SaaS relationship. The workflow evaluates exit provisions, rather than managing a complete migration.

What you need

Collect the master agreement, orders, amendments, data processing agreement (DPA), security schedule, service-level agreement, and incorporated product documentation or online terms. Preserve dated copies and identify the subscribed tier and modules. Functionality described for another tier does not establish this customer's entitlement.

Obtain these operational inputs:

• A data inventory covering records, attachments, metadata, relationships, audit history, configurations, and customer-created reports.
• Export documentation, API limits, sample files, and any supplier assistance proposal.
• Destination import requirements and an estimate of migration and validation time.
• Renewal, termination, suspension, and deletion provisions, including notice instructions.
• The customer's negotiation checklist, preferred terms, fallbacks, approvers, and transition budget.

Ask privacy and records teams which datasets require continued protection or retention. Separately establish whether the supplier has promised to export those datasets.

Use the template

Use SaaS Subscription Agreements — SaaS exit checklist to capture each issue. You can copy this table into your working document or spreadsheet; no dedicated template module is required.

Assign stable IDs such as EXIT-01 so redlines and technical findings reference the same row. In Source / version, record document ID, date, section, and page where available. In Evidence / gap, distinguish clause wording, test results, and missing commitments. Absence of a promise does not establish technical impossibility.

Use Trigger / window for the initiating event and the period following it. Dependency / cost captures administrator access, assistance, volume limits, and continuing fees. Put proposed wording or the required decision in Action / owner. Record severity, confidence, disposition, and approver in Status / approval; link longer explanations to the row ID.

Step by step

1. Establish which exit terms control

Read the precedence clause before extracting rights. Determine whether orders, product terms, or the DPA alter export, retention, or deletion provisions. Confirm that referenced documentation is available and its version identifiable. Check whether online terms can change during the subscription and how changes affect the exit commitment.

For illustration, §12.3 of a historical SEC-filed Salesforce agreement ranks the applicable order form above the master agreement and the master agreement above documentation. That hierarchy illustrates contractual wording, not a universal SaaS rule. See the filed agreement, §12.3.

Record controlling provisions and conflicts in the checklist. Where precedence remains unclear, seek clarification or an amendment rather than selecting the most favorable wording without support.

2. Define the export package the customer needs

Compare the customer-data definition with the operational inventory. Identify whether the promised export includes attachments, stable identifiers, record relationships, timestamps, audit logs, and customer-created configurations. Review exclusions for derived data, platform materials, and third-party content without assuming those exclusions are invalid.

Distinguish possession from usability. Records may be unusable at the destination if attachment links depend on the departing platform or fields lack a data dictionary. Ask the destination owner which formats, mappings, and relationships are essential, and which platform features can be abandoned.

Record each required category, the contractual commitment, and supporting technical evidence. Describe missing commitments explicitly. Proposed language should identify the needed deliverable, not demand an undefined “complete export.”

3. Reconcile the exit timeline with access rights

Map nonrenewal, termination, suspension, export requests, delivery, retrieval, validation, and deletion as separate events. Identify the notice recipient, delivery method, receipt rule, and calculation assumptions. Determine whether requests must precede termination and whether administrator or API access continues afterward.

Do not reuse one deadline for every event. In the historical Salesforce example, §11.2 provides a default nonrenewal notice period of at least 30 days, subject to order-form variation. It is neither an export deadline nor a statutory rule. See the filed agreement, §11.2.

Record the sequence and unresolved gaps. A request window without a delivery deadline may leave insufficient validation time. Check separately whether suspension, a payment dispute, or supplier-initiated termination interrupts retrieval.

4. Test portability and transition assistance

Have technical owners test a representative dataset containing linked records, attachments, and relevant metadata. Capture the dataset, service tier, export method, files, import results, and failures. Use an appropriately protected test environment. A successful test demonstrates observed feasibility, not a continuing contractual entitlement.

Review who prepares files, explains schemas, corrects export errors, and supports the destination team. Address response expectations, credentials, API throttling, and production access during validation. Check how changes made after an initial export will be captured.

If EU coverage is plausible, assess territorial scope, qualifying data-processing services, and exceptions. Data Act Articles 25 and 26 address written switching terms, assistance, continuity, and information about methods, formats, and restrictions. The generally maximum 30-calendar-day transition follows the notice period and is subject to extension provisions; Article 31 gives certain services special treatment. See Articles 25, 26, and 31.

Record test outcomes separately from contractual amendments and the legal applicability decision.

5. Assess exit costs and failed-performance exposure

Separate subscription fees, overlapping services, export charges, assistance fees, and early-termination amounts. Establish whether quotes are binding and whether repeat exports or error correction cost extra. For time-based assistance, seek defined scope, estimated hours, and approval controls.

Read export promises alongside suspension rights, liability limits, exclusions, and remedies. Identify the practical response if files arrive late or unusable: correction obligations, additional retrieval time, escalation, or other negotiated relief. Do not assume service credits address exit failures.

For covered EU services, Data Act Article 29 permits reduced switching charges capped at directly related costs during the transitional period. The prohibition on switching charges begins January 12, 2027, after this guide's October 13, 2026 cutoff. Distinguish switching charges from standard service fees and early-termination penalties. See Article 29.

Record supported amounts, pricing assumptions, and unresolved inputs; do not manufacture a total where hours or scope are unknown.

6. Align deletion with validation and privacy duties

Compare deletion timing with import and validation needs. Identify treatment of active systems, backups, and subcontractor copies; permitted retention exceptions; and available deletion confirmation. Do not assume an export request pauses deletion or that the customer can extend retention unilaterally.

For covered California service-provider or contractor relationships, §7051 requires specified processing purposes and use restrictions, oversight and remediation rights, and compliant subcontractor contracts. These requirements do not prescribe a universal export specification. Review retained transition copies against the applicable DPA and processing purposes. See 11 CCR §7051(a)–(b).

Record the proposed validation-before-deletion sequence, residual-copy restrictions, and privacy questions. Assign any conflict with applicable retention or deletion obligations to the privacy or records owner rather than treating longer retention as automatically preferable.

7. Turn findings into a review decision

Rank issues by impact, operational dependency, timing, and available remedy. Missing attachment exports may be critical for a document-intensive application even when another issue carries a larger projected cost.

For each material issue, prepare preferred wording, a fallback, and the operational reason. Assign business concessions to authorized approvers and suspected legal noncompliance to specialist review. Recheck definitions, survival language, and cross-references after redlining; confirm that another document does not displace the negotiated result.

The completed checklist should show the source position, proposed response, owner, and disposition. Close a row only when an amendment, verified evidence, or authorized risk acceptance addresses the stated issue. Risk acceptance must identify what remains unproven.

Worked example

Fictional scenario: Alder Finch Services is renewing HarborSlate, a fictional case-management SaaS platform. It needs matter records, linked PDF attachments, and activity timestamps for a future migration. Its fictional order covers an export-enabled tier. A pre-renewal test produces CSV records, but attachment links fail when tested outside the platform; destination import remains untested.

The fictional master agreement allows CSV requests within 15 days after expiry. Interactive access ends at expiry, and active-data deletion is scheduled 20 days later. No export delivery deadline is stated. Proposed assistance costs $175 per hour without estimated hours or a ceiling. All parties, documents, amounts, and terms are invented, not benchmarks.

The decision changes from “CSV export exists” to “usable exit is not demonstrated.” Failed links establish a problem with the tested output, not permanent loss of the attachments. Counsel seeks a defined attachment deliverable while the application owner tests mapping and import. The missing delivery deadline makes the deletion window unreliable for validation. Procurement needs scope and estimated hours before approving a budget; it cannot infer them from the hourly rate.

Common mistakes

• Equating ownership with retrieval. Assess export scope, format, timing, and assistance independently.
• Treating documentation as an unconditional promise. Verify incorporation, precedence, tier coverage, and version.
• Testing only flat records. Include the relationships, attachments, and metadata the destination needs.
• Ignoring suspension during exit. Determine how authorized users obtain data when ordinary access is unavailable.
• Assuming deletion waits for validation. Negotiate the sequence expressly and assign any residual risk.

Final quality check

• Material findings have precise document, version, and clause references.
• Precedence conflicts and missing incorporated terms are resolved or assigned.
• Export scope covers the technical owner's essential categories.
• Testing distinguishes observed results from untested assumptions.
• Notice, access, delivery, validation, and deletion form a workable sequence.
• Costs, assistance scope, and failed-performance remedies are assessed together.
• Legal overlays have scoped applicability decisions, and open issues have owners and approval status.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its contract review supports customer-side review in Word using deal-specific instructions. Findings quote clauses, rank severity, locate text, and identify missing language as not present. Lawyers can edit or insert suggestions as ordinary tracked changes in the signed-in Word user's name, or dismiss findings with reasons. Tabular review supports work across documents; counsel still verifies precedence, technical evidence, and legal applicability. To discuss this exit-review workflow, book a demo.

Frequently asked questions

Is a right to export CSV enough?

Only if it meets the customer's migration requirements. Test identifiers, attachment mapping, relationships, encoding, and field meanings. Separate contractual commitments from what a particular test demonstrates.

Should export rights survive termination?

Consider express retrieval and assistance rights for an agreed post-termination period. Address suspension, credentials, fees, delivery, and deletion as well; survival wording alone does not resolve those dependencies.

What if the supplier refuses destination compatibility?

Seek measurable source-side commitments: identified formats, schemas, mapping, delivery deadlines, and correction of defective exports. Have the destination owner assess import feasibility. Broad compatibility language is not a substitute for testing.

Does the EU Data Act make exit free now?

Not categorically. As of October 13, 2026, Article 29's switching-charge prohibition begins January 12, 2027. Assess coverage and timing, and distinguish switching charges from other amounts. See Article 29.

Sources

• SEC-filed Salesforce agreement and order forms, §§11.2 and 12.3 — historical contractual examples, not market standards.
• California CCPA regulations, effective January 1, 2026, §7051.
• EU Data Act, Articles 25, 26, 29, and 31.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.