---
title: "Your MSP contract: the exit, access and data clauses"
description: "Managed IT services contracts: administrator access, technical documentation, GDPR Art. 28 and notice periods, in 10 clauses. No-obligation proposal."
language: en
url: https://www.dataroad-it.com/en/msp-contract-exit-clauses-access-data/
source: https://www.dataroad-it.com/en/msp-contract-exit-clauses-access-data/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Managed IT services contracts: administrator access, technical documentation, GDPR Art. 28 and notice periods, in 10 clauses. No-obligation proposal.

# Your MSP contract: the exit, access and data clauses

At a glance For decision-makers short on time.

- 01 Administrator accounts always belong to the client, with a copy in a board-held vault.
- 02 The MSP must maintain and hand over the technical dossier for network, firewall and backups.
- 03 Where personal data is accessed, GDPR Article 28 requires a written agreement with the provider.
- 04 IT Unlimited: annual contract, no lock-in and no tie-in.

### In this article

**Switching MSP can take an afternoon or bring the company to a halt for weeks. The difference is written, or not, in the managed IT services contract.** Three questions decide the outcome: whose name the administrator accounts are in, who holds the network documentation and what happens to the data at the end of the relationship. We wrote this guide from the provider's side, with what DataRoad has learned in 11 years of taking on clients coming from other suppliers.

## Which clauses must you insist on?

- **Ownership of access** Every administrator account belongs to the client; the provider is never the sole holder.
- **Technical dossier** Inventory, network map, firewall and backup configuration, always up to date and handed over at the end.
- **Personal data** Where there is access to it, the GDPR (Article 28) requires a written agreement that includes returning or destroying the data at the end.
- **Exit** A workable notice period, no tie-in and no termination penalties.

## What does a contract that ignores the exit cost?

It costs weeks of dependence. Nobody asks about credentials while everything is going well; the question comes up the day the company wants to change, whether over price, quality or because it has grown. That is when cases like these appear:

- **Microsoft 365** The global administrator is the personal address of an engineer at the former provider.
- **Domain** The website address is registered with the supplier as registrant.
- **Firewall** Nobody knows the password, and the only way out is to wipe everything and reconfigure from scratch.
- **Backups** They are stored in a third party's cloud subscription.

No dishonesty is needed. It only takes a provider who, for convenience, put everything in its own name. The result is always the same: the client is held hostage. Before going ahead, read [our guide to switching IT provider safely](https://www.dataroad-it.com/en/switch-it-provider-portugal/).

## Who owns the administrator accounts?

The client, always. The MSP comes in with individual accounts, created by the company and switched off by the company on the last day of service.

**In practice:** administrator access opens every door in a system. A copy of each of those credentials must be kept somewhere the board controls, for example a business credential vault.

Demand in writing:

- **Break-glass access** A company account on every vital system: Microsoft 365, firewall, servers, wireless network and backups.
- **The right registrant** Domains, subscriptions and licences registered with the company as owner.
- **A shared vault** With direct access for management. See how to set up a [business password manager](https://www.dataroad-it.com/en/business-password-manager/).

## What network documentation should you receive?

Whatever allows another engineer to take over the next day. Without it, the new provider spends weeks rebuilding the map of the installation, and the client pays for those hours. The contract should require a living dossier with:

- **Equipment** Workstations, servers, switches, access points, firewall and UPS, all listed.
- **Network design** Topology, IP address plan and separate VLANs for staff, visitors and video surveillance.
- **Protection** Firewall policies and authorised VPN connections.
- **Backups** The [backup strategy](https://www.dataroad-it.com/en/managed-backup-services-portugal/): what, where to, how often and the date of the last verified restore.
- **Licensing** Software, associated contracts and renewal dates.

## What does the GDPR say about the IT provider?

It says the provider is a processor and needs a written agreement. In managing your servers and workstations, the MSP touches personal data, of clients, staff, patients or guests. The company is the controller; the provider processes on its behalf. Article 28 requires the agreement to ensure, among other points, that the provider:

- processes the data only on the client's written instructions;
- has its team bound by a duty of confidentiality;
- complies with the security measures set out in Article 32;
- does not engage another processor without prior authorisation;
- assists the client with data subject requests and with security and breach notification obligations;
- **when the service ends, returns or destroys the personal data**, as the client chooses, unless there is a legal duty to retain it;
- provides the information that proves compliance and allows audits.

DataRoad applies the technical measures; it does not provide legal advice. The final text of the agreement should be reviewed by the company's lawyer or its DPO.

## What notice period is reasonable?

One that allows an orderly transition without locking the client in. Multi-year tie-ins, early exit penalties and impractical termination periods are red flags. A serious MSP keeps clients through service, not small print.

The [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) contract is annual, renews automatically and has no tie-in. Two months is enough to hand over operations calmly without leaving the company unprotected. We also explain [why we only work under contract, never on one-off jobs](https://www.dataroad-it.com/en/managed-services-contract-no-one-off-callouts/).

## How are operations handed to the new MSP?

- **Dossier handover**: documentation reviewed and current.
- **Access**: all administrator credentials transferred or validated.
- **Handover session**: both providers sit at the same table.
- **Cutover**: the outgoing provider loses access only after the new one confirms it can get into everything.
- **Data**: returned or destroyed, with a written declaration.

For commitments during the contract, response times and penalties, see [the SLA clauses that make the difference](https://www.dataroad-it.com/en/managed-it-services-sla-clauses/).

## The 10-clause list to take to the meeting

| # | Topic | What to check |
| --- | --- | --- |
| 1 | Access | Administration in the client's name; the MSP uses individual accounts. |
| 2 | Domains and subscriptions | The company is the registrant. |
| 3 | Credential vault | Management has direct access at any time. |
| 4 | Technical dossier | Equipment, network, firewall and backups always up to date; handover guaranteed at the end. |
| 5 | Backups | Company-owned subscription and documented restores. |
| 6 | GDPR agreement | Every element required by Article 28(3), in writing. |
| 7 | End of data | Return or destruction, at the client's choice, with a declaration. |
| 8 | Termination | A workable notice period, zero tie-in, zero penalties. |
| 9 | Transition | Defined steps: joint session, credentials, access cutover. |
| 10 | SLA | Times and coverage windows described with no room for double readings. |

## What does an audit that protects your exit look like?

The France Affiches group (large-format printing, headquartered near Paris with operations in France, Spain and Portugal) asked DataRoad for a complete, on-site IT audit. The team analysed the network as it actually existed, the lifecycle and support status of each device, the firewall, privileged accounts, workstation protection and backups, including restore tests.

Every item was classified on three levels: risk to address now, technical debt to plan for, or acceptable. This survey is exactly what a company should have in hand before switching MSP. See [the audit carried out for France Affiches](https://www.dataroad-it.com/en/france-affiches-it-audit-paris/).

## Frequently asked questions about MSP contracts

### Can the MSP be the sole keeper of the passwords?

No. The provider uses the access while the contract runs, but ownership belongs to the client, with a copy in a vault open to the board.

### Do I need a GDPR agreement with whoever manages my IT?

You do, whenever that provider accesses personal data. Article 28 requires a written agreement, providing for the data to be returned or destroyed at the end of the service.

### Is there a lock-in in DataRoad's contract?

No. IT Unlimited runs for a year, renews automatically and has no tie-in period.

### What should I demand at the end of the contract?

Four things: the updated technical dossier, all administrator credentials, confirmation that domains, licences and backups are in the company's name, and a written declaration on what happened to the data.

## Next step: an access and contract check in 5 working days

We check who holds your company's administrator accounts, domains, licences and backups and deliver the list of what to fix so you are not dependent on any provider. Request a no-commitment proposal.

**More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt.

**Call to a Portuguese landline.*

## Source

- [Official GDPR text on EUR-Lex (Articles 28 and 32)](https://eur-lex.europa.eu/legal-content/PT/TXT/?uri=CELEX:32016R0679)

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[IT UnlimitedHow to measure the quality of your IT provider’s supportAlmost every IT provider says it responds quickly. Few show how they measure it. These are the five signals a decision-maker can ask for and…3 November 2026 · 2 min read](https://www.dataroad-it.com/en/how-to-measure-it-support-quality-provider/)[IT UnlimitedFunding network and IT infrastructure in 2026/2027: a CFO guideThere is no grant open for equipment alone. IT fits into innovation projects or into loans with a public guarantee, and those with the techn…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/financing-it-infrastructure-portugal-2026-2027/)[IT UnlimitedWhat does an hour of downtime cost? The maths for 20 workstationsFor a 20-workstation company, an hour of downtime costs close to €1,000, and only a third is salary: the rest is revenue that evaporates and…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/cost-of-it-downtime-calculation/)[IT UnlimitedManaged IT services by contract only: why there is no ad hocDataRoad only works under contract, with companies of more than 10 workstations. It is the only way to meet the signed service level and the…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/managed-services-contract-no-one-off-callouts/)[IT UnlimitedBack from holidays: September's week of IT checksAugust leaves laptops unpatched, backups unconfirmed and temporary accounts open. One week of checks is enough to start the last quarter wit…9 September 2026 · 5 min read](https://www.dataroad-it.com/en/september-it-checklist-after-summer/)[IT UnlimitedIT budget 2027: managed services at a fixed, predictable costWindows Server 2016 loses support in January 2027 and NIS2 demands demonstrable measures. Six budget lines and one rule to separate monthly …9 September 2026 · 6 min read](https://www.dataroad-it.com/en/it-budget-2027-managed-services-fixed-cost/)[IT UnlimitedManaged IT services SLA: what to demand before you signAn incident can drag on for days without breaching the SLA, as long as someone has responded. Resolution times, severity criteria and writte…15 August 2026 · 4 min read](https://www.dataroad-it.com/en/managed-it-services-sla-clauses/)[IT UnlimitedWhat does an IP phone system cost? The 5 parts of the priceThe most expensive phone system is the one that looks cheap in the proposal. Surplus concurrent channels, missing maintenance and a network …15 August 2026 · 4 min read](https://www.dataroad-it.com/en/ip-phone-system-cost-comparison/)[IT UnlimitedIP phone system: on-site, IP PBX or cloud? How to decideThe wrong phone system costs missed calls and bills that double. And the most expensive mistake is usually in the internal network, not the …15 August 2026 · 4 min read](https://www.dataroad-it.com/en/business-ip-phone-system-pbx-cloud/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed IT for business

## One StepAhead of IT.

One partner accountable for all of your company’s IT, with response times written into the contract and a monthly fee that does not move.

- **11** years in business, since 2015
- **PT · EU · US** remote and on-site support
- **232** clients under management

We do **IT** right.

DataRoad IT Unlimited

## Operational continuity is not luck. It is method and contract.

IT Unlimited reduces risk and shows in writing what changed.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/msp-contract-exit-clauses-access-data/