Vendor Offboarding Checklist Template

What the Vendor Offboarding Checklist Covers

1. 1
   Phase 1

   Phase 1: Exit Scope & Impact

   5 tasks

   The answers on the first task decide which tasks appear: termination for cause adds a task in Phase 2, the exit route sets the first tasks of Phase 4, and personal data adds two tasks in Phase 6.

   • Record the vendor, the service, the end date and the exit route — the reason for the exit, what happens to the service next, and whether the vendor processes personal data for you
   • List what depends on the vendor — sites, systems, integrations, reports, other suppliers and the teams that use the service
   • Estimate the cost of leaving — early termination fees, minimum commitments, exit assistance charges, double running and the replacement’s set-up costs
   • Check whether vendor staff could transfer with the service — in Great Britain, TUPE can apply when a service moves to a new contractor or back in-house; take advice early
   • Identify the risks of the exit — service gaps, data the vendor still holds, access you cannot see, knowledge only the vendor has, and how the vendor may behave once notice is served
2. 2
   Phase 2

   Phase 2: Contract Review & Exit Approval

   8 tasks

   No notice goes to the vendor until the exit approver records a decision on the last task. The checklist halts there.

   • Retrieve the signed contract and every amendment — order forms, statements of work, the data processing agreement and any renewal letters
   • Confirm the term, the end date and the notice period — check whether notice runs from the end date or an earlier auto-renewal date, and when it must be received
   • Check how notice must be given — the form, the address and the named recipient the contract requires, including any rules on email or courier
   • Check the termination clauses — termination for convenience or cause, cure periods, fees, and which obligations survive termination
   • Document the breach and the cure period — the evidence, earlier notices and any cure period; take legal advice before relying on termination for cause
   • Check the exit and transition assistance clauses — what the vendor must do after notice, any exit plan it owes you, and what it may charge
   • Check the data return and deletion clauses — the format, the deadline, what happens to backups and how the vendor confirms deletion
   • Approve the exit and the notice date — the approver confirms the exit route, the cost and the date notice will be served
3. 3
   Phase 3

   Phase 3: Notice & Exit Plan

   6 tasks

   • Prepare the notice of termination or non-renewal — cite the clause, state the end date and ask for exit assistance and the return or deletion of your data
   • Serve the notice in the form the contract requires — before the notice deadline, keeping proof of delivery
   • Get the vendor’s written acknowledgement — and check that its end date matches yours
   • Agree the exit plan with the vendor — milestones, the last service date, handover meetings and named contacts on both sides
   • Tell internal stakeholders the date and the plan — service users, site managers, IT, finance, accounts payable and the helpdesk
   • Stop new orders and renewals against the contract — close catalogues, block new requisitions and cancel any subscriptions that renew on their own
4. 4
   Phase 4

   Phase 4: Transition the Service

   6 tasks

   The exit route on the first task shows one of the first three tasks. The rest apply to every exit.

   • Confirm the replacement vendor is contracted and onboarded — before the last service date, through your normal vendor onboarding process
   • Confirm the in-house team is ready to take over — people, tools, training, budget and cover from the first day
   • Confirm users know the service is stopping — what replaces it, if anything, and who to contact
   • Collect knowledge and documentation from the vendor — procedures, site and system information, schedules, configurations and open issues
   • Run the handover or parallel period — check service levels while both are working and agree who fixes what
   • Confirm the outgoing vendor’s last service date — in writing, with any work still owed listed
5. 5
   Phase 5

   Phase 5: Remove Access & Recover Assets

   7 tasks

   The access tasks are assigned to the IT or security lead named on the first task. Remove access on the last service date, not weeks after it.

   • List every access the vendor holds — user and admin accounts, shared logins, API keys, VPN and remote support tools, badges, keys, fobs and alarm codes
   • Disable the vendor’s user accounts and remote access — in the identity provider, each application outside single sign-on, the VPN and remote support tools
   • Revoke API keys, tokens and integrations — and rotate any shared passwords or service account credentials the vendor knew
   • Collect badges, keys and fobs — and change alarm codes, door codes or locks where anything is missing
   • Recover your equipment, materials and documents — devices, stock, storage keys, drawings, records and anything bought under the contract
   • Agree the removal of the vendor’s own equipment — from your sites, with a date, and any making good the contract requires
   • Recheck for vendor activity a week after the last day — sign-in, VPN and badge logs should show no use of anything that was closed
6. 6
   Phase 6

   Phase 6: Data Return & Deletion

   6 tasks

   Two tasks appear when the vendor processes personal data for you. Under Article 28(3)(g) of the UK GDPR and the EU GDPR, the choice between return and deletion is yours as controller.

   • List every copy of your data the vendor holds — live systems, backups, exports, email, paper files and sub-processors
   • Give the vendor a written instruction to return or delete each data set — the format, the deadline and what happens to backups
   • Receive the returned data and check it — complete, readable, in the agreed format and loaded where it needs to go
   • Confirm sub-processors have returned or deleted the data too — a processor must pass its data protection terms to its sub-processors (Article 28(4)), so ask for their confirmation through the vendor
   • Obtain written confirmation of deletion — a certificate or letter covering the scope, the date, the method and any copies kept because the law requires it
   • Update your record of processing activities — where you keep one, remove or replace the processor and update any privacy information that names it
7. 7
   Phase 7

   Phase 7: Financial Close-Out & Records

   8 tasks

   • Reconcile the final invoices against the contract — check pro rata charges, exit assistance fees and early termination fees before approving payment
   • Claim credits, refunds and deposits — prepaid fees, unused service credits, retentions and deposits held by the vendor
   • Close open purchase orders — and release unused commitments and accruals in the ledger
   • Block the vendor in the vendor master once the final payment is made — stop new orders and payments, but keep the record and its history
   • Update the contract register and the vendor register — status, end date, reason for the exit and whether the vendor could be used again
   • File the exit record — notice, acknowledgement, access evidence, deletion confirmation and the final statement of account, kept for your retention period
   • Hold a lessons-learned review — what the contract made easy or hard, and what to change in the next contract’s exit terms
   • Sign off the completed exit — the exit approver confirms that no access, asset, data or payment is left open