What to write when the customer leaves and wants their data out

What the row is asking

Reviewers ask how a customer exports data when they leave, how that data is deleted, and how soon. A good answer names a file format a rival tool can open, a period, and a confirmation. If you have not decided, say not yet.

This row is not how long you usually keep customer data. That period, including deletion when the account closes, is the retention row. This row is the file they can take, the clock after they leave, and whether you confirm the deletion. A backup may still hold a copy after the live product deletes it. That leftover copy is the backup sentence.

Onplana, on a page dated October 7, 2026, says "Three answers should end an evaluation on their own: a compliance claim with no named standard, no committed breach-notification window, and no documented way to export and delete your data." The same page asks "How do I export my data on leaving?" A good answer names "Formats a rival tool can open." It asks "How is my data deleted on exit, and how soon?" A good answer names "A period and a confirmation." Question 13 on that page is how long data is retained. Questions 19 and 20 are the exit. The page treats those as different questions. Onplana writes vendor-review questions. This is their list, not a founder asking for help. The same page tells a reviewer to "Export your data and open it in a tool that is not the vendor's."

Cybersecify, by Ashok Kamat, on a page that says "Audit & Compliance June 27, 2026 Updated October 3, 2026", separates "Customer ability to export their data on demand" from "Data deletion process on customer offboarding". The deletion row asks for a "confirmation artifact (deletion certificate, log entry)." Those cells are samples the firm wrote. The page says the template comes from founder conversations in 2026 and does not name those founders.

A post on r/SaaS, July 17, 2026, from u/North-Class8742, says they are "Running a small SaaS." They wrote "a customer just sent a 200-question security questionnaire" and "What happened last time you got a data-deletion request or a security questionnaire. who actually handled it?" Company and headcount are not stated. The same day, u/rupert_at_work wrote "The expensive bit usually isn't the lawyer. It's the operational drag: finding where the data actually lives, answering the same questionnaire for the 19th time" and named an "owner for deletion requests." The next day, u/Important_Zebra7065 said the cost is founder, solo, and small-team time and sanity, not attorney fees. On August 17, 2026, u/EngageCompliance, who says they do data protection consulting, wrote "Best to do it yourself until it just gets too annoying or long to deal with alone" and named "bottlenecks for deletion". No fee is stated. No source here says a deal stalled on an export format.

What reviewers accept

Write the export format only when a tool that is not yours can open the file. Name that format. A file only your product can open is not the answer.

Write how soon the remaining data is deleted only when you know the number and what starts the clock. The account closing and the customer asking are different starts. Use the one you can point to.

Write a confirmation only when you actually give one: a deletion certificate or a log entry the customer can keep. If you do not send one, leave it out.

If you have not chosen the format, the clock, or the confirmation, say not yet or still deciding.

Name who handles a deletion request when that person is real. The July 17 question is who did the work. The cost people name is time, including finding where the data lives.

If the deletion clock is the same event as the retention sentence, you can name that event here, and you still write the export format and the confirmation. The retention sentence alone does not answer this row.

A backup that still holds a copy after the live delete is not a confirmation that the exit finished. Say that leftover copy in the backup sentence.

An honest gap is a complete answer. The answer that fails is a vague exit: no file another tool can open, and no period or confirmation for the delete.

What not to write

Do not write a format you have not opened in another tool.

Do not write a number of days you have not chosen.

Do not write a deletion certificate you do not send.

Do not answer how long you usually keep data here. That sentence is the retention row, including deletion when the account closes as that period.

Do not treat a backup that still holds a copy as a deletion confirmation.

Do not put the export format, the number of days, or the confirmation on the vendor row. There is no field for them.

Do not say the public page emails a deletion certificate. It does not.

Do not invent a format, a clock, a certificate, or a deal that stalled.

Where this answer lives

Keep these sentences in the questionnaire answer you control.

The public page shows your company name, a short summary, and a contact email. Each row shows the company, what it does, the processing location, the agreement link, and the date you saved it.

That table is the vendor list. It is not the file a customer takes when they leave.

There is no field for an export format, a number of days after the customer leaves, or a deletion confirmation. The page does not fill this row. The product does not email a deletion certificate.

If the editor already knows a company, a suggestion can offer a location or a public agreement link, and only after you use it. That suggestion does not write an export format, a number of days, or a deletion confirmation.

If you want the longer notes

How long you keep customer data, and deletion when the account closes as that period, is a different row from the file they take when they leave. What to write is in the data retention guide.

A backup may keep a copy after the live product deletes it. What to write for that leftover copy, a restore, and a recovery time is in the backup restore guide.

The short packet for a questionnaire, including where this sentence stays, is in the security questionnaire guide.