What happens when a cloud vendor's contract ends and they still hold copies of our records with personal data?

When a cloud vendor’s contract ends, the records and the personal data they contain do not stop being your responsibility. The vendor was acting as a custodian or processor on your behalf; you remain the records owner and the party accountable for protecting the personal information. A contract expiring does not, by itself, satisfy any retention obligation or privacy duty. What happens next depends almost entirely on what your contract required and on the steps you take during the transition.

Why the vendor still holding copies is a problem

Lingering copies create real exposure:

• Privacy risk. Personal data sitting in a system you no longer control, monitor, or pay for is a breach waiting to happen. The longer it persists, the larger the attack surface.
• Retention conflict. Personal data should generally be kept only as long as there is a lawful business or legal reason. Copies retained past that point can violate retention schedules and data-minimization principles.
• Discovery and access. Records held by a former vendor may still be subject to litigation holds, public-records or FOIA-type requests, and audits—but you may have no practical way to reach them.

What should happen at contract end

A well-managed exit follows the terms you negotiated up front:

1. Return of records to you (or a successor) in an agreed, usable format, with integrity and metadata preserved.
2. Certified destruction of all remaining copies—including backups, replicas, logs, and cached data—within a defined window after return.
3. Written confirmation, such as a certificate of destruction, documenting what was deleted, when, and by whom.

These obligations belong in the contract before signing, not after. Look for explicit data-return, deletion-timeline, backup-disposition, and audit-rights clauses.

What to do now if the contract is already ending

• Inventory exactly what personal data the vendor holds and where.
• Trigger the contractual return and deletion provisions in writing.
• Confirm deletion extends to backups and subcontractors.
• Obtain and file the destruction certificate as a record of your due diligence.
• Update your own retention and disposition documentation accordingly.

Treat vendor offboarding as a planned records and privacy event, not an afterthought. For broader guidance on handling personal and sensitive information, see the privacy and PII topic hub.