This free template is for subscription software and service businesses handling a customer who has asked to cancel. It takes the request from the first email to a closed account record: who asked and whether they can, what the contract says about notice and refunds, why the customer is leaving, the final invoice, the data export and deletion, and every login, key and integration that has to be switched off. Three scope questions tailor each run. A consumer subscription shows the consumer cancellation rules check, a customer whose personal data you process under a data processing agreement shows the delete-or-return task, and an EU customer moving to another provider shows the EU Data Act switching phase. Agencies ending a service engagement need different handover tasks; this checklist is written for subscription churn.
Most business software is cancelled under a contract. The contract decides the notice period, whether the term renews automatically, what happens to prepaid fees and how long the customer has to take their data. The work is mostly administrative, but it touches finance, support, engineering and whoever owns the data processing agreement, which is why steps get missed when the whole thing lives in one person’s inbox.
Consumer subscriptions carry extra rules about how cancelling itself must work. In the US, the Restore Online Shoppers’ Confidence Act requires a simple mechanism for consumers to stop recurring charges for anything sold online. California’s Automatic Renewal Law, amended by AB 2863 for contracts entered into, amended or extended from 1 July 2025, requires online cancellation for subscriptions bought online and allows a retention offer only alongside a prominent option to carry on cancelling. The FTC’s 2024 “click-to-cancel” amendments to its Negative Option Rule were vacated by the Eighth Circuit in July 2025; the FTC restarted the rulemaking with an advance notice in March 2026, so a new federal rule may follow. In the UK, the subscription contracts regime in the Digital Markets, Competition and Consumers Act 2024 is not yet in force, and the government has said it will start in January 2027.
Seven phases run from logging the request to closing the account record. Phase 5 appears only when an EU customer is switching to another provider. In Phase 2 the consumer cancellation rules task appears only for consumer subscriptions, and in Phase 6 the delete-or-return task appears only when you process the customer’s personal data under a data processing agreement.
Answer the scope questions first. They decide which legal tasks and which phase this cancellation shows.
Shown only when an EU customer is switching to another provider or to its own systems. Check with counsel whether your service is exempt.
Five sets of rules come up most often when a software or subscription customer leaves. Some depend on what you sell, some on where the customer is and some on whether you hold their personal data. The table says what each one means for this checklist; it is a starting point, not legal advice.
| Rule | Applies to | What it means at cancellation |
|---|---|---|
| GDPR and UK GDPR Article 28(3)(g) | You, where you process personal data for the customer as their processor | When the service ends, delete or return all the personal data at the customer’s choice, and delete existing copies unless law requires you to keep them |
| EU Data Act, Chapter VI | Providers of data processing services, SaaS included, to customers in the EU, since 12 September 2025 | Notice of no more than two months; up to 30 calendar days to switch, or up to seven months if justified; at least 30 days to retrieve data; switching charges capped at direct costs until 12 January 2027, then banned |
| Restore Online Shoppers’ Confidence Act (US) | Consumer subscriptions sold online | A simple mechanism to stop recurring charges, enforced by the FTC |
| California Automatic Renewal Law | Auto-renewing consumer subscriptions in California | Online cancellation for subscriptions bought online; a retention offer must sit beside a prominent option to continue cancelling |
| UK DMCC Act 2024 subscription regime | Auto-renewing consumer subscriptions in the UK | Not yet in force; expected January 2027, with an easy exit route, renewal reminders and cooling-off rights. Secondary legislation and guidance are still to come |
Most cancellation laws protect consumers, not businesses. The US federal and California rules and the UK regime apply to consumer subscriptions. A business customer’s cancellation is governed by your contract and DPA and, for an EU customer, the Data Act. Where you sell both ways, ask counsel which rules reach each plan, and keep the dates and outcomes in the checklist so you can show what happened.
Deleting is a promise about backups too. Most providers cannot edit a backup to remove one customer, so their DPA says data in backups expires on the normal retention cycle. Put that date in the deletion confirmation, so the customer is not surprised that a copy exists for a few more weeks.
Every task’s due date is offset from the day the checklist starts, so the effective date, the export deadline and the deletion date are set when the request is logged. Start the checklist from your billing or support tool through the API and webhooks.
Refunds stop at an approval step until finance answers, and the account cannot close until the CS lead confirms billing, data and access are done. Each decision sits in the checklist history beside the comments and attachments behind it.
Make the reason code a dropdown rather than a free-text note and reports show which reasons are rising. Conditional logic shows the consumer, DPA and Data Act steps only on the cancellations they apply to.
Offboarding is the mirror of onboarding: what the SaaS Customer Onboarding Checklist sets up is what you switch off here. The Customer Success Strategy Checklist defines the churn-save playbook behind Phase 3, and the Data Retention & Disposal Review Checklist catches customer data left behind once the account has closed.
Running the whole customer lifecycle? CheckFlow for client onboarding runs onboarding, handoffs and offboarding from the same templates, so every customer is set up, and let go, the same way.
The request and who made it, the contract’s notice, renewal and refund terms, the reason for leaving, the final invoice and any refund, the data export, deletion of the customer’s data with a written confirmation, and revocation of user access, API keys and integrations. Finish with a note to internal teams and a closed account record. Add the consumer cancellation rules where you sell to individuals, and the EU Data Act switching steps where an EU customer is moving to another provider.
No. The FTC’s 2024 amendments to the Negative Option Rule, known as click-to-cancel, were vacated by the US Court of Appeals for the Eighth Circuit in July 2025, days before the main compliance deadline. The FTC published an advance notice of proposed rulemaking in March 2026, which could lead to a new rule. Meanwhile the Restore Online Shoppers’ Confidence Act still requires a simple way for consumers to stop recurring charges for things sold online, and states such as California have their own laws.
Usually yes, as long as the offer does not stand in the way of cancelling. California’s Automatic Renewal Law allows a retention offer during an online cancellation only if a prominent link or button to continue cancelling is shown with it. For business customers the contract governs, but the same principle protects trust: make the offer once, accept the answer and process the cancellation on the date the contract allows.
If you process their personal data as a processor, you must delete it or return it, at the customer’s choice. GDPR Article 28(3)(g), with the same wording in the UK GDPR, also requires you to delete existing copies unless the law requires you to keep them. Your DPA usually sets the timescale and whether you issue a deletion certificate. Backups normally expire on their documented cycle rather than being edited, so say when the last copy goes.
It gives EU customers of data processing services, SaaS included, the right to switch to another provider or to their own systems. Since 12 September 2025 the contract must allow notice of no more than two months, a transitional period of up to 30 calendar days to move the data, and at least 30 days afterwards to retrieve it. Switching charges are limited to direct costs until 12 January 2027 and banned from then on.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
