Short Answer
Agree the exit rights at the start, not when the relationship is already ending.
The contract should distinguish the client’s source data, personal data, completed reports, the provider’s proprietary tools, system credentials, third-party accounts and transition assistance.
The client does not automatically own every provider tool simply because it paid for the service. Equally, the provider should not be able to leave the client without its own data or essential operational outputs when the contract ends.
Why This Matters
Termination is often the moment when the client most needs historical information.
It may need to move to another provider, continue operations internally, complete an audit, meet regulatory obligations, reconcile customers or defend a dispute.
A contract can create serious exit risk if report access ends immediately, data exports are available only for an extra fee, accounts sit in the provider’s name or data can be deleted before handover is complete.
The service may have worked well for years and still fail badly at exit.
Typical Scenario
A company outsources an analytics, technology or management function.
The provider operates through its own platform and produces recurring reports. The agreement clearly gives the client access during the term but says little about what happens after termination.
Management asks:
“Can we still use the reports and recover our data?”
That answer should already be in the contract.
Practical Analysis
01Separate client data from provider technology.
The provider may legitimately own its software, algorithms, methodology and templates while the client retains rights in the source information supplied from its business.
02Decide what report rights must survive.
Where reports are important for continuing operations, the client may need a continuing, non-revocable right to use completed outputs after fees are paid, while the provider keeps ownership of its underlying methodology.
03Define the data export before termination.
Specify the format, historical period, fields, attachments and timing. A PDF report may not be a workable substitute for structured operational data.
04Deal separately with personal-data return and deletion.
Return, retention, backups, deletion and sub-processors should follow the Personal Data Protection Act and the agreed processing instructions.
05Identify credentials and third-party accounts.
Advertising, analytics, booking, cloud or other service accounts may sit in the provider’s name. Decide whether they must transfer, be handed over or be recreated.
06Make transition assistance concrete.
A general promise to “cooperate” may be too vague. State the transition period, responsible contacts, exports, credential handover, successor-provider cooperation and any additional fees.
07Check suspension rights.
A provider may have legitimate suspension rights for non-payment, but those rights should not necessarily block access to the client’s own data or records needed for legal compliance.
The exit plan should also identify how long the provider must maintain access after notice is given. Immediate shutdown on the termination date may be operationally unrealistic if reports, credentials or data still need to be checked. A short controlled transition period can be more valuable than a broad promise to cooperate because it gives both sides a clear timetable and completion point.
What We Usually Look At
We review data rights, report licence, raw-data export, account ownership, credentials, personal-data return and deletion, transition support, suspension rights, unpaid-fee provisions and post-termination confidentiality.
Common Traps
Common mistakes are assuming the client owns all reports because it paid for them, waiting until termination to ask for exports, accepting unusable data formats, forgetting third-party credentials and allowing suspension rights to block essential records.
Practical Next Step
Add an exit deliverables schedule:
client data → reports → post-term licence → export format → credentials → transition support → deletion / retention
Ask:
“If this contract ended tomorrow, what would we need to continue operating on Monday?”
Legal Sources
- Personal Data Protection Act B.E. 2562 (2019), including sections 30, 33, 37 and 40 on access, erasure, controller duties and processor duties.
- Personal Data Protection Committee (PDPC) Notification on Security Measures of the Data Controller B.E. 2565 (2022).
- Copyright Act B.E. 2537 (1994), as amended, including sections 9–10 on works created by employees and commissioned works; Department of Intellectual Property consolidated statutory text.
- PDPC / GPPC official guidance on controller–processor arrangements, security and transition of personal data.
General legal information only. Please seek advice on your specific facts. Laws and regulatory practice may change.