In this article
In a managed IT services contract, the clauses that protect the business most are the exit clauses: who holds the administrator accounts, who keeps the network documentation and what happens to the data when the relationship ends. They are few, easy to check and should be read before signing. DataRoad writes this guide from the MSP side, after 11 years of seeing the same problems repeat themselves whenever companies change provider.
The four essential points
- Access All administrator accounts belong to the client company, never solely to the provider.
- Documentation Inventory, network diagram, firewall and backups kept up to date and handed over on exit.
- Data If the provider accesses personal data, Article 28 of the GDPR requires a written contract, including return or deletion at the end.
- Notice period A reasonable period, with no lock-in or exit penalties.
What goes wrong when nobody planned for the exit
While the service works, nobody asks where the credentials are. The surprise comes when the company decides to switch — over price, quality or growth — and discovers situations like these:
- Microsoft 365 The administrator account is tied to the email address of a technician at the former provider.
- Domain The website domain was registered in the provider's name.
- Firewall Nobody knows the password and the only way out is a factory reset.
- Backups The copies live in a cloud account that does not belong to the company.
It takes no bad faith to end up here; all it takes is a provider who, for convenience, registered everything in its own name. The effect is always the same: the company becomes dependent. To prepare the transition, read how to change IT provider without risk.
Administrator access: always the company's
The rule has no exceptions: access belongs to the client company. The MSP works with its own named accounts, assigned by the company, which can be disabled on the last day of the contract.
In simple terms: an administrator account is the master key to a system. The company should always keep a copy of every master key somewhere it controls, such as a business password vault.
The contract should provide for:
- Break-glass account In the company's name, for every critical system: Microsoft 365, firewall, servers, Wi-Fi and backups.
- Ownership Domains, licences and subscriptions registered in the company's name.
- Shared vault With direct access for management. We explain how it works in password managers for businesses.
The network infrastructure documentation stays with you
Without documentation, the next provider spends weeks discovering what exists — and that time is paid for. The contract should oblige the MSP to maintain and hand over a dossier with:
- Inventory Computers, servers, switches, access points, firewall and UPS.
- Architecture Network diagram, addressing and VLANs for staff, guests and cameras.
- Security Firewall rules and remote access via VPN.
- Copies The backup policy: what is copied, where to, how often and when the last restore test took place.
- Software Licences, contracts and renewal dates.
GDPR: what Article 28 requires in writing
Whoever manages your systems also accesses the personal data of clients, employees, patients or guests. Under the GDPR, your company is the controller and the MSP is a processor. Article 28 requires a written contract providing, among other things, that the processor:
- processes the data only on the company's documented instructions;
- ensures that anyone accessing the data is bound by confidentiality;
- applies the security measures of Article 32;
- engages another processor only with the company's authorisation;
- helps respond to data subjects and meet security and notification obligations;
- at the end of the service, deletes or returns all personal data, at the company's choice, unless the law requires it to be retained;
- makes available the information needed to demonstrate compliance and allows audits.
DataRoad implements the technical measures but does not provide legal advice. The final wording of the clauses should be validated by your lawyer or data protection officer.
Notice period, renewal and lock-in
Long lock-in periods, early exit penalties and notice periods that are impossible to meet are warning signs. A client should stay for the quality of the service, not because of a clause.
DataRoad's IT Unlimited contract is annual, renews automatically, has a 60-day notice period and no lock-in. Sixty days is enough for a smooth handover without leaving the company exposed. Why we always work under contract is explained in why DataRoad does not do one-off call-outs.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
How the handover should work
- Dossier — handover of up-to-date documentation.
- Credentials — handover or confirmation of all administrator access.
- Technical meeting — with the new provider.
- Deactivation — the outgoing MSP's accounts disabled only after the new provider's access has been confirmed.
- Data — return or deletion, confirmed in writing.
For response times and penalties during the contract, see our guide to what to demand in an IT SLA.
A 10-clause checklist
| # | Clause | To confirm |
|---|---|---|
| 1 | Ownership of access | Administrator accounts belong to the company; the provider uses its own named accounts. |
| 2 | Domains and licences | In the company's name. |
| 3 | Password vault | Direct, permanent access for management. |
| 4 | Documentation | Inventory, network, firewall and backups kept up to date and handed over on exit. |
| 5 | Backups | Accounts in the company's name and restore tests recorded. |
| 6 | GDPR data processing agreement | Written contract with the elements of Art. 28(3). |
| 7 | What happens to the data | Return or deletion at the end, at the company's choice, confirmed in writing. |
| 8 | Notice period and lock-in | Reasonable period, no lock-in or penalties. |
| 9 | Handover | Procedure set out: meeting, credentials and account deactivation. |
| 10 | Service levels | Response times and hours of cover written unambiguously. |
Real example: the France Affiches group audit
The France Affiches group, a large-format printer headquartered in the Paris region with sites in France, Spain and Portugal, commissioned DataRoad to carry out a full on-site IT audit. We analysed the actual network topology, the support status of the equipment, the firewall rules, privileged accounts, endpoint protection and backups, including restore tests.
The report classified each point as immediate risk, technical debt to plan for or acceptable. This is the survey that should exist, and remain in the company's possession, when changing provider. Read the France Affiches audit case.
Frequently asked questions
Can the MSP be the only one with the passwords?
No. It can use them during the contract, but all administrator accounts must belong to the company, with a copy in a vault that management can access directly.
Is a GDPR agreement with the IT provider mandatory?
Yes, whenever it has access to personal data. Article 28 of the GDPR requires a written contract with the processor, including the return or deletion of the data at the end of the service.
What notice period does the DataRoad contract have?
IT Unlimited is annual, renews automatically, has a 60-day notice period and no lock-in.
What should I receive when the contract ends?
Up-to-date documentation of the network and systems, all administrator credentials, confirmation that domains, licences and backups are in the company's name, and return or deletion of the data, in writing.
Access and contract check in 5 working days
DataRoad confirms who holds your company's administrator access, domains, licences and backups, and delivers a list of what is missing so you depend on no one.
More than 10 workstations · support contract · remote, on-site and telephone support. Request a no-obligation proposal.
