Key points
- At the end of a data processing agreement, the data entrusted to the processor cannot simply stay where they are; a precise outcome is required (Article 28(3)(g) of the GDPR).
- The controller chooses between return and deletion of the data; the processor does not decide alone.
- In both cases, existing copies must be destroyed, including in test environments, logs and backups.
- An exception preserves legal retention obligations (accounting, tax, employment and social security), which must be identified by a specific legal provision.
- This ties in with the storage limitation principle (Article 5(1)(e)): data must be kept only for as long as strictly necessary.
- The exit is made legally sound through a reversibility phase, a return format, the handling of backups and a certificate of deletion; these operations must comply with the security obligation in Article 32.
The end of a data processing agreement is a sensitive moment for personal data. Change of provider, termination, end of an assignment: in every case, the data entrusted to the processor cannot simply stay where they are. The GDPR requires a precise outcome, which combines a choice left to the controller, an obligation to destroy copies and a reservation for legal retention requirements. If poorly anticipated, this stage creates two opposite risks: unlawful retention of data by the former provider, or premature deletion that deprives the business of information it still needs. The end-of-contract clause, too often overlooked, therefore deserves the same attention as the security clauses.
Every situation is different: the arrangements depend on the contract, the sector and the applicable retention obligations. The analysis below sets out the framework, not advice tailored to a specific case.
What the GDPR requires at the end of a data processing agreement
Article 28(3)(g) of the GDPR expressly settles the question. At the end of the services, the processor must, “at the choice of the controller”, delete all the data or return them to the controller, and then delete existing copies, “unless Union or Member State law requires storage of the personal data”. This obligation is one of the clauses that the data processing agreement must include.
Return or deletion: the controller’s choice
The text does not let the processor decide alone: it is the controller who chooses between return and deletion. In practice, return is needed where the data must be migrated to a new provider or brought back in-house; deletion is appropriate where the controller already holds the data elsewhere. In both cases, the operation goes hand in hand with the destruction of the copies held by the processor, including in secondary environments (tests, logs, backups).
This choice is best exercised formally, by written instruction, and documented: it forms part of the demonstration of compliance that the controller must be able to provide.
The exception: legal retention obligations
Article 28(3)(g) reserves the case where Union or national law requires the data to be stored. Certain sector-specific obligations (accounting, tax, employment or social security obligations, for example) may justify keeping all or part of the data temporarily after the end of the contract. This exception requires you to identify the specific provision that justifies retention and its duration: it is not presumed and cannot serve as a pretext for general retention.
This ties in with the storage limitation principle in Article 5(1)(e): data are kept only for as long as strictly necessary for the purposes, then deleted or archived under a controlled regime.
Making the exit legally sound: reversibility, copies and proof
The end of the contract is not just a matter of erasure: it often requires a reversibility phase, during which the controller recovers its data in a usable format before they are deleted by the provider. Article 32 also requires these operations to be carried out securely: erasure must be effective and, ideally, certified.
- Provide for a reversibility period and the return format in the contract.
- Deal specifically with backups (deferred deletion according to the rotation cycle, governed by the contract).
- Require a certificate of deletion once the operation is complete.
- Extend the obligation to sub-processors.
In practice: organising the end of the contract
- Notify the processor in writing of the choice between return and deletion.
- Check whether any legal retention obligations apply and for how long.
- Plan the migration or the return in-house before erasure.
- Obtain proof that the data and copies have been destroyed.
- Update the record of processing activities and the map of processors.
Points to watch
- Deletion is not automatic: without an instruction, what happens to the data remains uncertain.
- Forgotten copies (backups, test environments) are a frequent source of non-compliance.
- The legal retention exception must be justified by a specific provision, for a fixed period.
- Reversibility and deletion are two separate steps: one does not entail the other.
When should you consult a lawyer?
A lawyer’s support is useful to draft an end-of-contract clause that works (choice, reversibility, backups, proof), to reconcile GDPR obligations with legal retention requirements, and to make a change of provider legally sound. This work forms part of negotiating the data processing agreement and, more broadly, of a GDPR compliance programme and of sound management of personal data (in French).
The analysis must be carried out case by case: the solution depends on the facts, the drafting of the contract and the applicable retention obligations.
What the law says
What happens to data at the end of the contract is expressly governed by the GDPR. The data processing agreement must stipulate that the processor, “at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing” (Article 28(3)(g)). The choice between return and deletion therefore belongs to the controller, and must be organised in the contract.
Official sources
- Article 28 of the GDPR (Regulation (EU) 2016/679), paragraph 3(g): CNIL (in French)
Every situation is different. To organise reversibility and what happens to data at the end of the contract, our data protection lawyers assist you.
