The short answer
Your data does not leave with the provider, but control can
When you end a contract with an IT provider, nothing automatically happens to your data. Mailboxes stay in your Microsoft 365 tenant, files stay in SharePoint or on your file server, and cloud workloads keep running in Azure, AWS or Huawei Cloud. What changes is who holds the keys. If the provider registered accounts in its own name, kept the only Global Administrator login, or stored your backups in its own vault, you can lose practical access to data you legally own.
A clean exit comes down to three jobs: take full control of every account, take a verified copy of everything the provider holds on your behalf, and get written proof that whatever remains on their side has been securely deleted. This guide covers each job for businesses in Dubai and across the UAE, and finishes with a full IT provider exit checklist you can work through before, during and after the switch.
Data ownership and storage
Where your data actually lives under a managed IT contract
Owning data and controlling it are two different things. Your company owns its emails, customer records and financial files, but a provider that set up your systems may have done so under its own accounts: a cloud subscription billed to the provider, a domain registered with the provider's email address, a backup platform that only the provider can open. None of that changes who owns the information. It does change how easily you can get it back.
Start the exit by mapping each type of data to the place it sits and the person who can actually reach it. The table below shows the pattern we see most often in UAE SMEs and corporates, along with what to request for each.
Data map: what to ask for, by data type
| Data type | Where it usually sits | Common control gap | What to request |
|---|---|---|---|
| Email, files, Teams chats | Your Microsoft 365 tenant | Provider holds the only Global Administrator account | Global Administrator access in an account your business owns |
| Servers and cloud workloads | Azure, AWS, Huawei Cloud or on-premises servers | Subscription or account registered to the provider | Transfer of account ownership, billing and owner or root access |
| Backups | Provider's backup platform, sometimes hosted outside the UAE | Encryption keys and the backup console stay with the provider | A full backup copy, the encryption keys and the retention history |
| Business applications (ERP, accounting, patient or student records) | Application databases, hosted or on-site | Database admin passwords and vendor support contacts held by the provider | A database export in a documented format, admin credentials, vendor contacts |
| Domains, DNS, SSL certificates | Domain registrar and DNS host | Domain registered under the provider's account | Registrar transfer to your account and a DNS zone export |
| Network and security settings | Firewalls, switches, Wi-Fi, VPN | Configuration exists only on the device and in the provider's notes | Configuration backups and admin credentials for every device |
| Documentation and ticket history | The provider's documentation and ticketing tools | Lives in the provider's systems, not yours | Exports of diagrams, runbooks, the password vault and ticket history |
| Licences and assets | The provider's licensing account and asset register | Licences billed through the provider, asset list never shared | A licence list with renewal dates and the full asset register |
Contract review
Read the contract before you give notice
Your negotiating position is strongest before the provider knows you are leaving. Check these clauses first, so your handover requests match what was actually agreed.
- Data ownership. The contract should state that all data, configurations and documentation created for you belong to your business.
- Data return. Look for the format, the timeline and whether there is a charge for exporting data or backup copies.
- Exit assistance. Check whether handover hours are included, billed separately or missing altogether.
- Notice period and renewal. Auto-renewal dates and notice windows decide your real timeline.
- Deletion obligations. The provider should commit to deleting your data, including backups, and confirming it in writing.
- Licence commitments. Annual licence terms bought through the provider may not be cancellable mid-term, so plan transfers around renewal dates.
- Subcontractors and data location. Find out which third parties and which countries were involved in storing your data.
If you are lining up a replacement now, write these exit terms into the new agreement from day one. Our guide to what UAE businesses should demand in an IT support SLA covers the clauses worth negotiating before you sign.
Handover inventory
What your outgoing provider should hand back
Access credentials and admin accounts
Global Administrator for Microsoft 365, owner access for Azure, AWS and Huawei Cloud, plus admin logins for firewalls, switches, servers, the domain registrar and every business application.
Backups and encryption keys
A full, current copy of every backup set, the keys needed to decrypt it and the retention history. Ask for it in a format your next data backup service can actually restore.
Data exports
Exports of anything held in the provider's own systems: hosted databases, file shares on their servers, archived mailboxes and old project data.
Third-party integrations
API keys, connectors and service accounts behind your ERP sync, payment gateway, scan-to-email printers, SMTP relays and single sign-on apps. These break quietly when an account is disabled.
IT documentation
Network diagrams, IP plans, firewall rules, runbooks, the password vault export and the full ticket history, including known issues still open at handover.
Licences and asset records
Every software licence with quantities, terms and renewal dates, plus the asset register: laptops, servers, network gear, serial numbers and warranty status.
Data export and migration
Moving data without losing its structure
The best migration is often no migration. If your Microsoft 365 tenant or cloud account is already registered to your company, you usually only need to change who administers it, not move the data anywhere. Migration becomes necessary when the provider hosted data on its own servers or set up accounts in its own name.
When data does have to move, raw files are the easy part. What gets lost is the structure around them:
- Folder and file permissions, sharing links and group membership
- Metadata such as created dates, authors and version history
- Mailbox rules, delegated access and shared mailbox settings
- Teams chats, channel files and archived records
A planned cloud migration moves a pilot group first, keeps the source untouched until the copy is verified, and has a rollback point if something does not match.
Verification
How to verify data integrity before you sign off
Count and compare
Compare item counts and sizes between source and destination: mailbox items, files per folder, database row counts. For large file transfers, compare checksums so a corrupted file cannot slip through.
Restore something real
A backup report is not proof. Restore a mailbox, a virtual machine and a database copy into a test environment and confirm they open and work. Record what you restored and when.
Let the data owners check
Ask department heads to open the files they rely on. Finance checks closing balances, HR checks employee records, clinics check patient files. They spot gaps an engineer would miss.
Revoking access
Revoke access in the right order
Cutting off the old provider on day one feels safe, but it often locks your own team out of systems nobody else has the passwords for. Cutting them off too late leaves a live door into your network. The order matters more than the speed.
Treat the old provider's access like that of a departing employee with administrator rights: every account, every remote tool and every shared password gets reviewed, not just the ones you remember.
The access revocation sequence
- Secure your own way in first. Create business-owned administrator accounts protected by MFA, and confirm the incoming team can log in to every system.
- Remove delegated access. Delete the old provider's partner relationship and delegated admin rights in Microsoft 365, plus any cross-account roles in AWS or similar access in Azure and Huawei Cloud.
- Disable named accounts. Switch off every account the provider's staff used, including generic ones such as "support" or "itadmin".
- Rotate shared secrets. Change service account passwords, API keys, Wi-Fi keys, firewall and VPN credentials, and backup encryption passwords where the platform allows it.
- Remove remote tools. Uninstall the old provider's remote monitoring agents, remote desktop tools and VPN profiles from every device.
- Check the logs. Review sign-in and audit logs for the following weeks to confirm nothing from the old provider is still connecting.
Secure deletion
Secure deletion and written confirmation
Once you hold a verified copy, the provider should delete everything it still keeps: production copies, backup sets, replicas, archives, test environments and exports sitting on staff laptops. Old hard drives they hold for you should be returned or physically destroyed.
Timing matters. Ask for deletion only after your own verification is complete, and only after any records you are legally required to keep are safely held by you or your new provider.
What a deletion confirmation should state
- Which data sets were deleted
- Every system and backup location covered
- Backup copies and replicas included
- The deletion or wiping method used
- The date deletion was completed
- Who carried out the deletion
- Any data retained, with the reason
- A planned deletion date for retained data
- Physical disks returned or destroyed
- Signature of an authorised person
UAE compliance
UAE privacy and compliance points that shape an exit
Federal PDPL
Federal Decree-Law No. 45 of 2021 on personal data protection has applied since 2 January 2022 and is supervised by the UAE Data Office. When processing ends, a processor is expected to either erase the personal data or return it to the business that owns it, and liability for a processor's failings can reach back to that business.
DIFC and ADGM
The two financial free zones sit outside the federal law and run their own regimes: the DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. If your company is licensed there, check those rules for data return, deletion and transfers.
Health data
Federal Law No. 2 of 2019 on ICT in health fields generally requires health data to be stored in the UAE and kept for at least 25 years. A clinic changing provider must not let a migration move patient records offshore, or let a deletion request wipe records it is required to keep.
Two practical points follow for every UAE business. First, find out where the old provider kept your backups. Offsite copies are sometimes stored in another country, and you need to know that before you can confirm they were deleted. Second, if your migration routes data through, or to, a location outside the UAE, check the cross-border transfer conditions before the move rather than after. Our overview of data localisation and privacy laws in the UAE explains how these rules fit together.
Government entities and education providers often carry additional security requirements from their own regulators or parent authorities. This guide is practical, not legal advice: for contract disputes or regulated data, involve your legal adviser early.
Exit risks
Common exit risks and how to avoid them
- Vendor lock-in. Backups in a proprietary format, licences tied to the provider's account, and scripts only their engineers understand. Ask for open export formats and documentation of every custom script before notice.
- Incomplete backups. Backup jobs that silently skipped Teams, SharePoint, laptops or a cloud application, or retention that was shorter than you assumed. Only a restore test reveals this.
- Forgotten accounts. Old admin logins, service accounts, vendor portals and a domain registrar account tied to the provider's email address. Any of these can stay active for years after the contract ends.
- Rushed migrations. A cutover squeezed into the last week of the notice period, often just before month-end close or a long Eid or National Day weekend, when nobody is around to fix what breaks.
Rushed exit versus planned exit
- Notice sent before anyone checks who owns the accounts
- Old provider cut off before the new team has admin access
- Backups assumed complete, never restored
- No written confirmation that copies were deleted
- Business-owned admin accounts created before notice
- Overlap period with both providers working together
- Test restores recorded and signed off by data owners
- Signed deletion confirmation filed for audit
The checklist
IT provider exit checklist: before, during and after the transition
Use this checklist as the working document for your exit. Give each item an owner and a date, tick it off only when there is evidence, and keep the completed list with your handover records. The timeline below shows how the three phases usually line up against your notice period.
How the phases line up
-
Before notice
Secure control and build the map
Ownership checks, admin accounts, contract review, data map, first test restore.
-
Notice period
Handover and overlap
Written handover request, joint meeting, access transfer, exports and verification.
-
Cutover
Switch and revoke
New tools live, old access removed, shared secrets rotated.
-
First 30 days after
Confirm and close
Log reviews, deletion confirmation, final invoices, exit file archived.
Phase 1
Before you give notice
Quiet preparation while the relationship is still normal.
- Confirm the Microsoft 365 tenant, cloud accounts and domains are registered to your company
- Create a business-owned Global Administrator account with MFA, held by a director or IT manager
- Review the contract for notice, exit assistance, data return, deletion and fees
- Build the data map: every system, where its data sits, who controls it
- Request the latest backup report and run your own test restore
- Collect diagrams, firewall configurations and the password vault export
- List third-party integrations, API keys and service accounts
- Get the licence list with renewal dates and the asset register
- Brief the incoming provider and give them read-only access for discovery
- Pick a cutover date away from month-end close and long public holidays
Phase 2
During the transition
Both providers working in parallel, nothing switched off early.
- Send written notice with a dated list of handover items
- Hold a joint handover meeting with both providers
- Transfer admin access and confirm the new team can log in everywhere
- Export or migrate data, keeping the source intact until verified
- Verify integrity with counts, test restores and owner checks
- Run the first full backup on the new platform and test a restore
- Transfer licences and domain registrations to your own accounts
- Replace monitoring, antivirus and remote support agents
- Remove the old provider's delegated access and named accounts
- Rotate shared passwords, service account credentials and API keys
Phase 3
After the switch
Proof that the exit is finished, kept on file.
- Review sign-in and audit logs for activity from old accounts
- Confirm records you must retain are held by you or the new provider
- Request a signed deletion confirmation covering backups and replicas
- Reconcile final invoices and cancel leftover subscriptions
- Update your list of who processes personal data on your behalf
- Update the asset register, documentation and incident contacts
- Hold a 30-day review and close every open item
- Archive the exit file: handover list, test results, deletion confirmation
Frequently asked questions
Who owns my data when an IT provider manages my systems?
Your business owns its data. The provider only processes it on your behalf. The practical issue is control: if accounts, subscriptions or backups were set up in the provider's name, you need them transferred to your company before you can use that ownership. Checking this early is the single most useful step in any exit.
Can my IT provider refuse to hand over admin passwords or data?
A professional provider should not, and most contracts include handover obligations. Under the UAE PDPL, a processor is expected to erase or return personal data when processing ends. If a provider delays, put your requests in writing with dates, refer to the contract clauses, and involve your legal adviser if it continues. Having your own Global Administrator account in place before notice removes most of this risk.
Should I cancel the old provider before the new one starts?
No. Plan an overlap so both providers work during the notice period. The incoming team needs time to confirm access, run backups and verify data, and the outgoing team needs to be available to answer questions. Remove the old provider's access only after the new environment has been checked.
Do we have to move off Microsoft 365 when we change IT provider?
Usually not. If the tenant is registered to your company, your email, files and Teams data stay where they are. You change the administrators, remove the old provider's partner relationship and delegated access, and move your licence billing to the new partner. A tenant migration is only needed when the old provider set the tenant up under its own name.
What should a certificate of data deletion include?
It should list the data sets deleted, every system and backup location covered, the method used, the completion date and who performed the work. It should also name anything retained, why it was kept and when it will be deleted, and it should be signed by an authorised person at the provider.
Does UAE law require my old provider to delete my data?
For personal data under the federal PDPL, a processor is expected to erase the data or return it when processing ends. Companies in DIFC or ADGM follow their own free zone data protection rules, and health data falls under Federal Law No. 2 of 2019, which generally requires storage in the UAE and retention for at least 25 years. Write the deletion requirement into your exit request either way, and take legal advice for regulated data.
What gets forgotten most often during an IT provider exit?
Service accounts and API keys behind integrations, the domain registrar login, backup encryption keys, remote support agents left on laptops, and old admin accounts with generic names. These rarely appear on a handover list unless you ask for them by name, which is why they sit in the checklist above.
Planning a provider change?
Rounak Computers has supported businesses in Dubai and across the UAE since 2004, with certified in-house engineers and Gold partnerships with Microsoft, AWS and Huawei. If you want a second opinion on your exit plan or a structured handover, our team can walk through it with you.
