What should we do when a vendor still holds our records and the contract is ending?

When a contract ends but a vendor still holds your records, the central principle is simple: the records remain yours, and you are accountable for them. Outsourcing storage or processing does not transfer ownership or your legal and regulatory obligations. Treat contract exit as a planned records event, not an afterthought.

Confirm What the Vendor Holds

Start by inventorying the records and data in the vendor’s custody. Ask for a complete, itemized accounting that includes:

• The full population of records, by record type, format, and date range
• Associated metadata, audit logs, and access histories
• Any backups, copies, or derivative data the vendor created
• Records subject to active legal holds or open requests (such as FOIA or litigation)

Reconcile this list against your own retention schedule so you know what must be kept, what is eligible for disposition, and what is under hold.

Get Your Records Back in Usable Form

Negotiate return well before the contract closes. Records should be delivered in open, non-proprietary, machine-readable formats with their metadata intact, so they remain accessible, authentic, and reliable once back in your control. Verify completeness and integrity on receipt, and capture chain-of-custody documentation for the transfer. Standards such as ISO 15489 emphasize maintaining records that are authentic, usable, and trustworthy throughout their lifecycle, including custody changes.

Confirm Secure Disposition by the Vendor

Returning your copy is only half the task. Require the vendor to certify, in writing, the secure and irreversible destruction of all remaining copies, backups, and fragments after transfer is confirmed. Do not authorize destruction of anything subject to a legal hold or open request.

Build Exit Into Future Contracts

Most disputes at contract end trace back to weak terms at the start. For future agreements, address up front:

• Ownership, return format, and return timelines
• Data security, breach notification, and audit rights
• Certified destruction of residual copies
• Cooperation during transition to a successor or in-house system

Treating data return and disposition as deliverables, not favors, keeps you in control.

For broader context on governing records across people, processes, and third parties, see the information governance topic hub.