Who owns your data when you change managed IT support providers?

Your business usually remains the data controller for information it collects and uses, while a managed IT support provider commonly acts as a data processor when it stores, accesses or manages that information on your instructions. Changing providers does not normally transfer ownership of the underlying business records. However, ownership, control, intellectual property and ongoing access are separate issues that should be examined before the changeover.

Under UK data protection law, the organisation deciding why and how personal data is processed is generally the controller. The provider must process that information in accordance with the agreed instructions and applicable data protection requirements. The service agreement should identify these roles, set out permitted processing activities, and explain how the provider uses subcontractors, cloud services and other suppliers.

Ownership can become less straightforward where the provider has created or adapted materials while delivering the service. These may include:

• network diagrams, asset registers and technical records;
• scripts, automation routines and bespoke configurations;
• security policies, monitoring rules and operational procedures;
• reports, audit evidence and incident records; and
• templates, software tools or other materials developed independently by the provider.

The contract should distinguish between your organisation’s information, the provider’s pre-existing intellectual property, and materials created specifically for your environment. It should also grant the rights needed for the business or its replacement provider to keep operating the systems after termination. Without clear wording, a business may possess the records but lack permission to reuse a tool, script or document needed to administer them.

Cloud services require a separate check because the outgoing provider may not own the platform or the tenant in which information is held. Confirm who controls each account, who is named as the customer, where administrative ownership sits, and whether the subscription can be transferred without exporting and rebuilding the environment. This is particularly important for email, file storage, backup platforms, identity systems, domain registrations and security services.

A controlled transition should establish an information and access register before termination. It should record the systems involved, data categories, retention requirements, dependencies, privileged accounts, service accounts, encryption arrangements, backup locations and any third parties with access. The incoming provider should receive only the permissions needed for its role, while unnecessary accounts and former administrative privileges are removed as responsibilities move.

Personal data should be transferred using an agreed method that protects confidentiality and integrity. The parties should verify the recipient, use appropriate encryption, maintain an audit trail and confirm that the transferred records are complete and usable. Passwords and other secrets should not be placed in ordinary email or shared documents. They should be changed or securely rotated as part of the handover, especially where the outgoing provider or its personnel previously had privileged access.

Retention is another important part of ownership and control. The outgoing provider may need to retain limited records to meet legal, regulatory, insurance or dispute-related obligations, but it should not keep information indefinitely without a valid reason. The exit terms should state what will be returned, what will be securely deleted, the relevant timescales, and how deletion or continued retention will be evidenced. Backup copies need specific treatment because they may expire through the normal backup cycle rather than being removable immediately.

Before the outgoing arrangement ends, the business should obtain written confirmation that:

• the replacement provider can access all agreed systems and information;
• critical processes have been tested rather than merely documented;
• administrative ownership and billing responsibility are correctly assigned;
• old privileged accounts, remote-access methods and integrations have been reviewed;
• data held by subcontractors has been addressed; and
• the agreed return, retention and deletion actions have been completed.

Disputes often arise because a contract describes the service but says little about exit. Review termination assistance, notice requirements, data export formats, charges for transition work, ownership of bespoke materials, confidentiality obligations and restrictions on withholding access. If the agreement is unclear, obtain legal and data protection advice before giving notice, particularly where the provider holds regulated information or operates systems that are essential to the business.

A managed IT support provider should be able to explain how it separates customer information from its own tools and intellectual property, how access is controlled during a transition, and how the exit record will be maintained. A clear contractual framework and a documented handover help ensure that changing providers does not interrupt the organisation’s control of its information.