Computer contract: the exit and data clauses that must be required

8 min read · DataRoad

An information technology contract Good work is not evaluated on the day it is signed. It is evaluated on the day it ends. It is at that moment that it is discovered whether the company has the passwords for its own systems, whether there is documentation of the network, and whether the data is returned in its entirety. The clauses that must be required are few, simple, and easy to verify — as long as you read them before signing.

We wrote this guide from the perspective of the service provider. In 11 years on the market, we have seen the same problems repeated with each change of provider — and almost all of them were avoided with a half-dozen lines in the contract.

Why the exit is the most important part of the contract

While everything is going well, no one asks where the passwords are. The problem arises when the company decides to change suppliers — for price, quality, or because it has grown — and realizes that:

• The Microsoft 365 administrator account is registered to the old technician's email;
• the domain of the website was registered in the name of the provider;
• no one knows the firewall password, and the only way to get in is to reset the device to its factory settings;
• The backups are in a cloud account that is not owned by the company.

None of these situations require malice. All that is needed is a supplier who, for convenience, handled everything on their behalf. The result is the same: the company becomes a hostage. If you are in this situation, see how to prepare the transition. change computer company without risks.

Passwords and administrator access: who owns them?

The rule is simple: all accesses belong to the client company. The provider works with its own, nominal accounts that are assigned to it — and that can be deactivated on the day the contract ends.

In practice, this means that the contract must provide for:

• an emergency administrator account, in the name of the company, for each critical system (Microsoft 365, firewall, servers, Wi-Fi network, backups);
• registration of domains, licenses and subscriptions in the company's name;
• a shared password vault that the administration has direct access to. We explain how it works in the article about password manager in the company.

Network documentation: the map that you need to keep with you

Without documentation, the new supplier spends weeks figuring out what is available — and that time is paid for. The contract should oblige the supplier to keep the dossier updated and deliver it upon departure, containing:

• inventory of equipment (computers, servers, switches, access points, firewall, UPS);
• network diagram, addressing and VLANs (separate networks for team members, guests, and cameras);
• firewall rules and remote access (VPN);
• backup policyWhat was copied, where, how often, and when was the last recovery test performed;
• list of licenses, software contracts and renewal dates.

Data and GDPR: what the article 28th says

When an IT provider accesses their systems, they also access personal data — from customers, employees, patients, or guests. Under the General Data Protection Regulation (GDPR), your company is the “data controller” and the provider is a “subcontractor.”.

Article 28 of the GDPR requires that this relationship be governed by a written contract. Among other things, the contract must stipulate that the subcontractor:

1. only processes data subject to documented instructions from your company;
2. guarantees that anyone accessing the data has assumed a commitment to confidentiality;
3. adopts the security measures required by Article 32;
4. only use another subcontractor with the permission of their company;
5. it helps to respond to requests from data subjects and to comply with security and notification obligations;
6. at the end of the service, deletes or returns all personal data, as chosen by your company, unless the law requires its retention;
7. it provides the necessary information to demonstrate compliance and allows audits.

An important note: DataRoad implements technical measures, but does not provide legal advice. To finalize these clauses, please validate the text with your lawyer or data protection officer.

Pre-notification, renewal and loyalty

Be wary of long-term loyalty contracts, penalties for early departure, or pre-termination notices that are difficult to fulfill. Stick with a provider for the quality of their service, not for a clause.

In DataRoad, the contract IT Unlimited It is an annual plan, with automatic renewal, 60 days of advance notice and no commitment. Sixty days is the time required for a testimony transfer done calmly, without leaving the company exposed. And if you want to understand why we always work on a contract, we explain in Why we don't provide point-of-care IT support (and why it protects your company).

Witness testimony: how the exit should unfold

The contract should describe what happens in the final days of the relationship, and not leave it up to anyone's good will:

1. delivery of the updated documentation dossier;
2. delivery or confirmation of all administrator credentials;
3. a technical meeting with the new supplier;
4. deactivation of the supplier's accounts that are being closed, after the new access has been confirmed;
5. return or deletion of the data, with written confirmation.

For response times and penalties during the contract, see our guide on SLA in IT contracts: what to require.

Checklist: 10 clauses to confirm in your IT contract

A real case: IT audit in France Affiches

The group France Affiches, a large-format printer based in the Paris region and with units in France, Spain and Portugal, asked DataRoad for a complete IT audit conducted on-site. The scope included the actual network topology, the state of the equipment, the firewall rules, privileged accounts, equipment protection, and backups — including recovery tests.

The result was a written report that classifies each point as either an immediate risk, a technical debt to be planned for, or acceptable. It is exactly this type of report that should exist — and remain in the company’s possession — when a provider changes. Read the report case France Affiches.

Frequently Asked Questions

Can the IT provider keep my company's passwords?

You can use them during the contract, but you should not be the only one to have them. All administrator accounts must belong to the company, with a copy in a password vault that the administration has direct access to.

Do I need a GDPR agreement with the IT company?

Yes, whenever the provider has access to personal data in their systems. Article 28 of the GDPR requires a written contract with the subcontractor, which includes, among other points, the return or deletion of the data at the end of the service.

What is the pre-notice period for the DataRoad contract?

The IT Unlimited contract is annual, with automatic renewal, 60 days’ notice, and no commitment.

What do I get when I finish the contract?

The updated documentation of the network and systems, all administrator credentials, confirmation that the domains, licenses, and backups are in the company's name, and the return or removal of the data, confirmed in writing.

Technical review of your contract and access within 5 working days

We verify who holds the administrator access, domains, licenses, and backups of your company, and deliver the list of what is missing to avoid being dependent on anyone. For companies with more than 10 seats · support contract · remote, local, and telephone support.

Sources

• Regulation (EU) 2016/679 (GDPR), EUR-Lex — Article 28 (Subcontractor) and Article 32 (Security of processing)