Can you get your data out?

The obstructions we see

• "It's not your data." Claims that the database, its structure or anything created in the system belongs to the vendor, so it cannot be handed over.
• Exports by the handful: documents downloadable 100 at a time, from one matter at a time, for a firm holding millions.
• Exports that lose the meaning: files with no link to their matter, no version history, no dates or authors; emails without attachments; ledgers as printed reports rather than transactions you can reconcile.
• Throttled access: API limits tightened, or API access charged for, just as you start to migrate.
• Proprietary formats that only the vendor's own tools can read.
• Exit fees for "migration assistance" at rates nobody would accept in a competitive quote.
• Access switched off on the contract end date, before the new system is live and checked.
• Slow support: exit requests queued behind everything else, and refusals to deal with the incoming vendor or your adviser.

It is your data

Your clients, matters, documents, emails, time, bills and ledgers belong to the firm. Under UK GDPR the firm is the controller of the personal data in them and the vendor is a processor, and the processing contract must require the vendor to return or delete that data at the end of the service, at your choice. Your regulatory duties to keep and produce records do not end because a supplier contract has. The grey areas are things like the vendor's own templates and standard configuration, which is exactly why the contract should define what you get.

"All your data" means all of it

A usable exit needs clients and matters with their relationships, custom data, documents with version history and metadata, filed emails with attachments, notes, key dates, time, bills, and the client and office ledgers as transactions that can be reconciled to the penny. Your own precedents and the configuration you paid for should be included too, or at least documented.

Protect yourself before you sign

1. Define "customer data" widely in the contract: everything the firm or its clients created or uploaded, including custom data and your own precedents.
2. Specify the export: complete, in bulk, in standard formats, with relationships and metadata, delivered within a stated number of days, at no charge or a fixed charge.
3. No throttling: API and export limits must not be reduced, or charges introduced, during notice or exit.
4. Time to leave: continued access, at least read-only, for a set period after termination, at a stated price.
5. Cooperation: the vendor must work with your incoming vendor and advisers in good faith.
6. Test it: take a full sample export during selection, and a full export every year after that. If it is hard when you are a happy customer, it will be harder when you are leaving.

If you are already leaving

Start the export early, in writing, and keep a record of every request and response. Check your contract and your data processing terms for what you are entitled to. Take a full copy of everything you can reach while you still have access. And if a vendor is obstructing you, take advice early: an independent adviser, and if needed a lawyer, can often change the tone of the conversation quickly.

What to ask, and what to see

1. Show a complete export of a sample firm, including documents with versions, emails and ledgers.
2. How long would a full export of our data take, and what would it cost?
3. What limits apply to exports and the API, and can they change during notice?
4. How have you handled customers who left in the last two years? Can we speak to one?