Your MSP contract: the exit, access and data clauses

• Ownership of access Every administrator account belongs to the client; the provider is never the sole holder.
• Technical dossier Inventory, network map, firewall and backup configuration, always up to date and handed over at the end.
• Personal data Where there is access to it, the GDPR (Article 28) requires a written agreement that includes returning or destroying the data at the end.
• Exit A workable notice period, no tie-in and no termination penalties.

It costs weeks of dependence. Nobody asks about credentials while everything is going well; the question comes up the day the company wants to change, whether over price, quality or because it has grown. That is when cases like these appear:

• Microsoft 365 The global administrator is the personal address of an engineer at the former provider.
• Domain The website address is registered with the supplier as registrant.
• Firewall Nobody knows the password, and the only way out is to wipe everything and reconfigure from scratch.
• Backups They are stored in a third party's cloud subscription.

No dishonesty is needed. It only takes a provider who, for convenience, put everything in its own name. The result is always the same: the client is held hostage. Before going ahead, read our guide to switching IT provider safely.

The client, always. The MSP comes in with individual accounts, created by the company and switched off by the company on the last day of service.

In practice: administrator access opens every door in a system. A copy of each of those credentials must be kept somewhere the board controls, for example a business credential vault.

Demand in writing:

• Break-glass access A company account on every vital system: Microsoft 365, firewall, servers, wireless network and backups.
• The right registrant Domains, subscriptions and licences registered with the company as owner.
• A shared vault With direct access for management. See how to set up a business password manager.

Whatever allows another engineer to take over the next day. Without it, the new provider spends weeks rebuilding the map of the installation, and the client pays for those hours. The contract should require a living dossier with:

• Equipment Workstations, servers, switches, access points, firewall and UPS, all listed.
• Network design Topology, IP address plan and separate VLANs for staff, visitors and video surveillance.
• Protection Firewall policies and authorised VPN connections.
• Backups The backup strategy: what, where to, how often and the date of the last verified restore.
• Licensing Software, associated contracts and renewal dates.

It says the provider is a processor and needs a written agreement. In managing your servers and workstations, the MSP touches personal data, of clients, staff, patients or guests. The company is the controller; the provider processes on its behalf. Article 28 requires the agreement to ensure, among other points, that the provider:

1. processes the data only on the client's written instructions;
2. has its team bound by a duty of confidentiality;
3. complies with the security measures set out in Article 32;
4. does not engage another processor without prior authorisation;
5. assists the client with data subject requests and with security and breach notification obligations;
6. when the service ends, returns or destroys the personal data, as the client chooses, unless there is a legal duty to retain it;
7. provides the information that proves compliance and allows audits.

DataRoad applies the technical measures; it does not provide legal advice. The final text of the agreement should be reviewed by the company's lawyer or its DPO.

One that allows an orderly transition without locking the client in. Multi-year tie-ins, early exit penalties and impractical termination periods are red flags. A serious MSP keeps clients through service, not small print.

The IT Unlimited contract is annual, renews automatically and has no tie-in. Two months is enough to hand over operations calmly without leaving the company unprotected. We also explain why we only work under contract, never on one-off jobs.

1. Dossier handover: documentation reviewed and current.
2. Access: all administrator credentials transferred or validated.
3. Handover session: both providers sit at the same table.
4. Cutover: the outgoing provider loses access only after the new one confirms it can get into everything.
5. Data: returned or destroyed, with a written declaration.

For commitments during the contract, response times and penalties, see the SLA clauses that make the difference.

The France Affiches group (large-format printing, headquartered near Paris with operations in France, Spain and Portugal) asked DataRoad for a complete, on-site IT audit. The team analysed the network as it actually existed, the lifecycle and support status of each device, the firewall, privileged accounts, workstation protection and backups, including restore tests.

Every item was classified on three levels: risk to address now, technical debt to plan for, or acceptable. This survey is exactly what a company should have in hand before switching MSP. See the audit carried out for France Affiches.

We check who holds your company's administrator accounts, domains, licences and backups and deliver the list of what to fix so you are not dependent on any provider. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• Official GDPR text on EUR-Lex (Articles 28 and 32)