Check supplier data deletion before closing the exit

The replacement service is running. The outgoing supplier sends a deletion certificate, and procurement is ready to close the contract. Then someone asks whether the certificate includes documents attached to support tickets and copies in the supplier's recovery environment.

Supplier data deletion evidence needs a defined scope. A certificate can support a particular deletion claim while leaving other copies unaccounted for. The useful exit record shows what was returned, what was destroyed, what remains and who must verify the next action.

This guide offers an original review method for Australian risk teams. The insurer example is fictional. Privacy, records-management, security and legal owners should determine the applicable obligations; this workflow is not a prescribed regulatory checklist.

Establish the retention decision before requesting deletion

Ending a contract does not settle which records must be kept. Under Australian Privacy Principle 11.2, covered entities must take reasonable steps to destroy or de-identify personal information they no longer need for a permitted purpose. Exceptions include Commonwealth records and retention required by Australian law or a court or tribunal order. The OAIC's APP 11 guidance also explains that an organisation can hold information without physically possessing it.

Ask the records and legal owners to identify the relevant retention basis, data categories and end condition. A supplier's standard retention policy needs to be assessed against those obligations and the contract. Avoid treating “we keep everything for seven years” as an answer covering every record type.

For APRA-regulated entities, CPS 230 requires an orderly-exit capability for material arrangements, subject to applicable relief. It does not prescribe a universal deletion deadline or certificate. The broader administrator-exit tabletop guide covers transfer and receiving-service readiness; this review examines the information left behind.

Build a copy-by-copy exit record

Start with the service's information flows and ask the supplier to reconcile them against its proposed deletion scope. Include the places where people work around the main application: support attachments, diagnostic exports, shared folders, test environments, archives and subcontractor systems. Ask the technical owner which of these actually exist for your service.

A compact record can use one line for each distinct location or treatment:

• Data category and service or tenant identifier.
• Supplier, subcontractor and system holding the copy.
• Proposed action: return, destroy, de-identify or retain with a documented basis.
• Prerequisite, responsible owner and planned completion or review date.
• Evidence reference, exclusions and current decision.

Keep the data description specific enough to test without copying customer records into the tracker. “Support attachments for the exited tenant” is more useful than “all data”. An unknown location stays an open question until someone can account for it.

ISACA's practitioner discussion of defensible data disposition, published in 2021, stresses the importance of tracing source and downstream systems. Deleting a downstream copy can be undone by a later refresh from its source. It is professional commentary, not an Australian legal rule; use that dependency question when checking the exit sequence.

Separate return, deletion and access removal

Before instructing irreversible destruction, have the receiving owner confirm that the required export is usable and that relevant preservation obligations have been addressed. Record the approval and any conditions. A successful download alone does not show that the receiving team can read the files or continue outstanding work.

Then separate three outcomes in the exit record. The organisation may have received its required records, the supplier may have removed a production workspace, and former support accounts may have been disabled. Each needs its own evidence. None establishes the other two.

Use the supplier privileged-access review for the account-removal work. For the data review, ask who can still retrieve retained copies after ordinary service access ends. That question includes authorised supplier administrators and subcontractors, not only your organisation's former users.

Ask what the deletion evidence actually covers

Match the supplier's completion statement to the copy-by-copy record. Useful evidence identifies the tenant or data set, systems covered, completion date, method, person or function responsible, verification performed and exclusions. A policy describes the process; a completion record should connect that process to this exit.

For a hosted application, ask for appropriate service-level records or a scoped demonstration. Where physical storage media are being sanitised, the technical team can assess the method against relevant guidance. NIST SP 800-88 Revision 2, published in September 2025, includes a sample sanitisation certificate recording media, method, tools, verification and validation. It is US technical guidance, not an Australian deletion obligation or proof that a cloud tenant's every copy was removed.

Ask which subcontractor locations the evidence includes and which require separate confirmation. A certificate issued by the direct supplier should make that boundary clear. If direct inspection is unavailable, document the assurance relied on and its limits rather than recording a test that nobody performed.

Keep verification proportionate and authorised. Do not request a fresh export of personal information merely to demonstrate that an old copy existed.

Treat backup retention as a question to resolve

“We delete backups on rotation” describes a schedule. It does not establish that retaining those copies is appropriate. The OAIC's APP 11 guidance includes archived and backup copies within the destruction or de-identification obligation and expects verification when a third party is instructed to destroy information.

The OAIC's security guide explains the limited circumstances in which electronic information cannot be irretrievably destroyed. Putting information “beyond use” requires inability and no attempt to use or disclose it, no access for another entity, appropriate security including access logs and audit trails, and a commitment to destroy it when possible. Routine backup retention should not be assumed to meet those conditions.

Have privacy and security owners assess the claimed limitation. Request the affected backup scope, reason deletion cannot occur now, available technical options, controls and proposed final treatment. Ask what happens if a recovery restores the exited tenant's information into an active environment. Record who will prevent or address that outcome and how the control will be checked.

Fictional example: one certificate, three outcomes

A small insurer leaves a document-processing supplier. Its operations team accepts the required export. The supplier's certificate confirms deletion of the production workspace, but the exit inventory also identifies an attachment in the support platform and a copy in a disaster-recovery backup.

The reviewer records three different outcomes:

1. Production deletion verified within scope. The certificate and supporting completion record identify the correct tenant and production system. They exclude support and backup systems.
2. Support-copy evidence pending. The supplier must confirm the attachment's treatment and provide completion evidence. The service owner keeps this action open.
3. Backup treatment under review. Privacy and security owners assess the supplier's stated limitation and proposed controls. A scheduled expiry date is recorded as a proposal, not an accepted exemption or proof of deletion.

The commercial service has ended, but the residual-data work has not. That distinction prevents an administrative contract closure from silently removing the remaining actions from view.

Close the evidence gaps explicitly

Give each remaining item an owner, next evidence request and review date. Keep the supplier contact and escalation route available after termination. Reassess missed dates or contradictory evidence through the organisation's established risk process.

Apply the remediation-closure guide when deciding whether a later response resolves the specific gap. Preserve the decision record under your organisation's retention arrangements, with restricted evidence links rather than unnecessary copies of personal information.

For teams organising supplier evidence and follow-ups, Contrata's assessment and engagement capabilities may support that work. Retention decisions, verification judgments and compliance responsibility remain with the organisation.