Who owns our data under fully managed IT support?

Under fully managed IT support, the business usually remains the data owner and determines why and how its information is used. The IT provider generally acts as a service provider or data processor, administering the technology that stores, transmits and protects that information. Technical access to data does not, by itself, transfer ownership of it.

Ownership should be considered separately from several related rights and responsibilities:

• Business data: Customer records, employee information, financial files, operational documents, email content and other information created or collected for the organisation remain subject to the organisation’s rights and governance.
• System administration: The provider may hold privileged credentials or configure systems that contain business data. This is administrative authority, not ownership.
• Provider materials: The provider’s own procedures, documentation, monitoring tools, scripts, templates and technical know-how may remain its intellectual property unless the agreement states otherwise.
• Software and subscriptions: Licences are governed by their own terms. A managed IT agreement should clarify whether subscriptions are held in the customer’s name, the provider’s name or through a reseller arrangement, and what happens to them when services end.

Data protection law adds an important distinction. The business will commonly be the controller because it decides the purpose of processing, while the managed IT provider processes personal data on the business’s documented instructions. The exact roles depend on the services and the data involved, so the agreement should identify them rather than relying on a general statement about ownership.

A suitable data processing agreement should describe the categories of personal data, the types of data subjects, the permitted processing activities, confidentiality requirements and the provider’s security obligations. It should also cover how the provider handles requests from individuals, personal data breaches, audits, legal demands and any use of subcontractors or other processors. If data may be accessed or transferred outside the UK, the relevant international transfer arrangements should be documented as well.

Access should be limited according to the work being performed. Good contractual and operational controls include named administrator accounts, multi-factor authentication, role-based permissions, approval for exceptional access, logging of privileged activity and prompt removal of access when an engineer no longer needs it. The business should also retain suitable administrative control over its core accounts, domains, backups and other critical services rather than allowing ownership to become dependent on an individual provider account.

Backups require particular attention because they may contain historical copies of information that has been changed or deleted in live systems. The contract should state who owns backup data, where it is held, how long it is retained, who can restore it and how copies are securely erased when retention ends. It should also distinguish between restoring data for the business and using backup systems for testing or troubleshooting.

The agreement should explain what happens when the managed service changes or ends. Important points include:

• the format in which business data and configuration information will be returned;
• which records, credentials, licences and technical documentation will be handed over;
• how the business can retrieve data from hosted platforms and backup repositories;
• how long transition assistance will continue and what activities are included;
• when the provider must delete remaining production, backup and temporary copies; and
• what evidence of deletion or transfer will be supplied.

Retention must also be handled carefully. A provider should not keep data indefinitely simply because it once had access to it, while the business must still meet its own legal, regulatory and operational retention requirements. The contract and internal retention schedule should therefore be aligned, including rules for legal holds, archived records and secure disposal.

For a business using fully managed IT support, the practical test is whether it can identify its data, control the accounts and permissions surrounding it, understand every party that may process it, and recover or remove it without ambiguity. S2 Technology Group can help businesses review these ownership, access and exit arrangements as part of a broader managed IT and security plan, but the final allocation of rights should be recorded in the service agreement and applicable data protection documentation.