Question Clearly sourced

Expert knowledge for digital decisions

How do I exit – what do I get, and by when?

Short answer

At the end of the contract, you will receive information from Ouhud GmbH upon request. Regardless of any agreement, Article 28 Paragraph 3 Letter g of the GDPR applies to personal data: The processor must delete or return it after processing at the choice of the controller. However, the most effective exit protection is established at the beginning of a project, not at the end.

The Exit List

A viable exit consists of six items. If one is missing, switching providers is practically blocked, even if contractually allowed.

Item Useful Format Why
Data set CSV, JSON, or complete SQL dump Open formats can be imported into any target system
File attachments and documents Archive with mapping file Without mapping to the data record, they are nameless files
Source code with version history Repository copy The history explains why something was built that way
Operational documentation Text, no screenshot album Environment, dependencies, planned tasks, interfaces
Access Transfer, not sharing Domain, DNS, certificates, accounts with third parties
Deletion proof Written, with date Demonstrates compliance with Article 28 Paragraph 3 Letter g of the GDPR

The Difference Between Export and Migratability

An export is a file. Migratability means that another system can read it. These are two different things, and the difference only becomes apparent during the first attempt.

Therefore, request a test export during the term – preferably in the first operational year when no one is upset yet. This is the only test that counts. A clause that guarantees an export says nothing about its usability.

Retention Obligations Continue

Anyone shutting down a system containing invoices, receipts, or bookings is not freed from their tax obligations. According to § 147 Paragraph 3 AO and § 257 Paragraph 4 HGB:

Documents Period
Commercial books, inventories, annual financial statements, management reports 10 years
Booking documents 8 years
Received and sent commercial and business letters, other documents 6 years

The period for booking documents has been reduced from ten to eight years; the shortened period has been in effect since the beginning of 2025. According to § 147 Paragraph 2 AO, documents must remain available, immediately readable, and machine-readable throughout the entire retention period. A pure table export does not necessarily fulfill this. Clarify with your tax advisor whether you need an archiving system or if the old system must continue to run in read mode – this is not a detail but often the most expensive item of a switch. This text does not replace tax advice.

What Should Be Included in the Contract

  • Deadline for provision after termination, calculated from the receipt of the termination, not from the end of the contract.
  • Transition operation for compensation: Continued operation under known conditions for a specified period, so that the switch does not take place under time pressure.
  • Support for migration at an hourly rate already stated in the contract. Later negotiations are conducted from a weak position.
  • Deletion period and deletion proof for all copies, including backups – with the realistic note that backups only disappear after their retention cycle expires.

Data is Not a Lever

One point that needs to be honestly addressed: In disputes over outstanding invoices, there are occasional attempts to withhold data. This is sensitive when it comes to personal data. The processor acts according to Article 28 of the GDPR on the instructions of the controller; the obligation to release and delete under Article 28 Paragraph 3 Letter g of the GDPR is not conditional on paid invoices. Payment claims must be enforced through the designated channels.

What Helps More at the Beginning Than Any Exit Clause

  1. Domain and DNS registered to your company, not to the service provider.
  2. Accounts with hosts and third-party services in your name, service provider as a user with rights.
  3. Read access to the repository from day one.
  4. Operational documentation as a deliverable with acceptance.

Those who have these four points rarely need the exit clause. Those who do not will lose months even with the best clause.

Key facts

Legal Basis
Article 28 Paragraph 3 Letter g of the GDPR obliges the processor to delete or return personal data at the choice of the controller.
§ 147 Paragraph 3 AO
Annual financial statements and commercial books for 10 years, booking documents for 8 years, other documents for 6 years.
Period
The period for booking documents has been reduced from ten to eight years and has been in effect in this form since the beginning of 2025.
Legal Basis
§ 147 Paragraph 2 AO requires that documents remain readable and machine-readable throughout the entire period.
Principle
A test export during the term is the only reliable test for migratability.

Sources

All external claims are backed by traceable sources.
  1. 01
    Verordnung (EU) 2016/679 (Datenschutz-Grundverordnung) Amt für Veröffentlichungen der Europäischen Union
  2. 02
    § 147 AO – Ordnungsvorschriften für die Aufbewahrung von Unterlagen Bundesministerium der Justiz / Bundesamt für Justiz
  3. 03
    § 257 HGB – Aufbewahrung von Unterlagen, Aufbewahrungsfristen Bundesministerium der Justiz / Bundesamt für Justiz

Ready for your next project?

Free initial consultation - no sales pressure, just clear answers.

Request consultation