Procedure
Supplier Exit and Data Return Procedure
This procedure defines the steps for managing the termination of a supplier relationship, ensuring that access is revoked, data is returned or securely deleted, contractual obligations are confirmed as fulfilled, and the transition to an alternative supplier or in-house capability is conducted without operational disruption or residual data risk.
- Type
- Procedure
- Version
- 1.0.7
- Date
- 2026-11-07
- Owner
- Supplier Risk Maintainer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Supply Chain Governance: Exit Management
- Review frequency
- Annual and upon significant change to supplier landscape or regulatory requirements
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Exit triggers
- Roles and responsibilities
- Exit planning
- Data return and deletion
- Access revocation
- Contract closure
- Post-exit review
- Exit timeline summary
Related documents
- supply-chain/
README.md (opens in a new tab) source - Supplier and Cloud Governance Frameworksupply-chain
- Third-Party and Supply Chain Risk Standardrisk
- Supplier Security and Privacy Assurance Standardsupply-chain
- Cloud Exit and Data Portability Standardsupply-chain
- Supplier Risk Register Templatesupply-chain
- Subprocessor Register Templatesupply-chain
- Privacy and Data Governance Policyprivacy
- Data Protection and Privacy Breach Response Procedureprivacy
- Data Retention Schedulegovernance
- Corrective and Preventive Action (CAPA) Procedurecompliance
- Access Control Proceduresecurity
Next
All Documents