The Closing Ledger: Six Evidence Points for UK Supplier Data Offboarding

A supplier contract is not only a commercial instrument. For a UK controller, it is also a boundary around data: what may be processed, by whom, for how long, and under what safeguards. When that boundary closes, the data-governance obligation does not close with it. The exit must be controlled, recorded and capable of being explained after the relationship has ended.

Too often, offboarding is managed as a procurement afterthought: a closure checklist, a final invoice, a returned laptop. That is not enough. The relevant question is not whether the supplier has left the estate. It is whether the organisation can demonstrate what happened to the data, who could still reach it, and what residual evidence remains if a regulator, auditor or board asks.

Begin with the exit as a data event

The first discipline is to treat supplier exit as a data-governance event with a defined owner, timetable and evidence standard. Legal, procurement and information security will all have roles, but the data-governance function should be accountable for the record. That means linking the exit to the record of processing activities, the retention schedule, the access estate and any live legal hold.

A useful starting position is to ask three questions before notice is served. What data does the supplier hold, including copies, backups, logs and derived outputs? Where does it sit, and which sub-processors are involved? What will remain provable once the contract ends? The six tests below turn those questions into an evidence model.

Test one: scope the exit against the data map

An exit plan that refers vaguely to all data is not a plan. Before the termination date, the organisation should extract from its data map the categories, systems, locations and formats relevant to the supplier. This should include primary copies, test data, archived records, support logs, backup media and any derived datasets created by the supplier.

The evidence point is a signed exit scope that names the data categories, the systems in scope, the return format and the deletion standard. It should also identify exclusions and explain why they are excluded. If the supplier cannot produce a data map of its own, that itself is a governance finding to record.

Test two: evidence return and deletion to a defined standard

Under UK GDPR Article 28, the contract should require the processor to return or delete personal data at the controller's choice. In practice, the exit file needs more than a closing email. It needs a return record showing the format, date and recipient of returned data, and a deletion record showing the method, scope and date of deletion.

The deletion standard must be defined. Does it include backups, disaster-recovery copies and sub-processor holdings? Is cryptographic erasure acceptable? Are there lawful retention exceptions, such as a legal hold or a statutory record-keeping duty? The evidence point is an attestation that answers those questions, names any residual data and gives a review date. A certificate that says data has been deleted without identifying the scope is weak evidence.

Test three: close access, not just accounts

Supplier access often outlives the contract in quiet forms: an API key, a shared service account, a remote-support route, a federated identity, a shared drive or an administrator account held for contingency. The exit should therefore be tested against the access estate, not only the HR or procurement leaver process.

The evidence point is an access revocation record that lists every credential, identity, integration and support route in scope, confirms the date and method of closure, and records who verified it. A final sign-off from information security is useful, but it should point to the underlying evidence rather than simply assert that access has been removed.

Test four: trace the sub-processor chain

A supplier exit is rarely a single-entity event. Sub-processors may hold data, provide backup services, operate support desks or host infrastructure. If the chain is not traced at exit, the controller may believe the data has been returned when a downstream copy remains.

The evidence point is a sub-processor exit schedule. It should list the sub-processors engaged for the relevant services, confirm that each has returned or deleted data and revoked access, and identify any gaps. Where a sub-processor cannot confirm deletion, the organisation needs a documented risk decision, not an assumed closure.

Test five: preserve the transition record

The exit file should also capture the transition itself. That includes knowledge handover, unresolved data-quality issues, open incidents, outstanding subject access requests, live legal holds and any changes to retention. These are not merely project notes; they explain why the final data position looks as it does.

The evidence point is a transition record that a person unfamiliar with the contract could read and understand. It should state what moved, what was deleted, what remains, who approved the position and what still requires action. This is the document that prevents an evidence gap after the people who managed the exit have moved on.

Test six: assemble the residual evidence pack

After the contract closes, the organisation should hold a residual evidence pack. At minimum, it should contain the exit plan, the data-map extract, return and deletion attestations, access revocation evidence, sub-processor confirmations, the transition record, approvals and an exceptions register.

The pack should be stored in the governance repository, linked to the supplier record and assigned a retention period. It should also be tested for retrievability. An evidence pack that cannot be found, opened or explained within a reasonable time is not a control. The final test is simple: could the organisation answer an ICO enquiry or a board question about the exit without reconstructing the story from memory?

A controlled close, not a quiet fade

Supplier offboarding is a governance event because it changes the data estate. The six evidence points do not make the exit slower for its own sake; they make it defensible. They allow UK teams to show that data was returned or deleted to a defined standard, access was closed, the sub-processor chain was addressed and the rationale survived the contract.

That is the difference between a supplier that has gone and a data relationship that has been properly closed. The closing ledger should be built before the door shuts, not after.