Question: Is there an offboarding process to ensure data return, deletion, and access termination when a supplier relationship ends?

Why This Matters

Without structured termination steps, residual access or retained data can lead to data leakage and compliance violations.

Maturity

0 — Unaware
No formal offboarding process.

1 — Ad Hoc
Handled manually per case.

2 — Defined
Checklist for data return and access revocation.

3 — Managed
Offboarding workflow with sign-off and evidence.

4 — Integrated
Linked to contract expiry and asset registers.

5 — Optimized
Automated offboarding and confirmation dashboards.

How to Level Up

| From → To | Actions | |—|—| | 0 → 1 |Identify vendors with access to systems or data.| | 1 → 2 |Create termination checklist (data return, revocation, evidence).| | 2 → 3 |Implement workflow for approval and sign-off.| | 3 → 4 |Integrate with contract management and asset inventory.| | 4 → 5 |Automate reminders and verification steps. |

Enablers

People: Procurement, IT Admin, Privacy Officer
Process: Trigger → Verify → Record → Close
Technology: Workflow automation, contract system

Evidence

Completed offboarding checklists
Data deletion certificates
Access revocation logs

KPIs

Number of vendors offboarded per quarter
Percentage with evidence of data deletion
Average closure time (days)

Low-Cost / Open-Source Options (MSME)

Common Pitfalls

Vendor retains data post contract
Credentials not revoked from shared systems
No verification of data deletion

Compliance Mapping