What Happens to Employee Data When an HRIS Contract Ends

When an HRIS contract ends, your employee data doesn't come back automatically. You usually get a limited export window, in the formats the vendor chooses, and then the vendor deletes or returns the data on its own schedule. What you can recover depends almost entirely on what your contract says and what you extract before you give notice.

This is for HR directors, HRIS owners and legal teams planning a system change. A common mistake we see: teams read the data return clause for the first time after they've already told the vendor they're leaving, when their bargaining power is at its lowest.

Key takeaways

• Read the MSA, data processing addendum (DPA) and order forms for export windows, formats and fees before you signal that you're leaving.
• Core employee fields export easily. Payroll history, audit logs, custom fields and integration data are where gaps appear.
• Your retention duties don't end with the contract. Federal rules alone require payroll records for at least three years and employment tax records for at least four.
• Under GDPR, a processor must delete or return personal data at the end of services at the controller's choice. Get that in writing, including backups and subprocessors.
• Start extraction 60 to 90 days before notice and keep a chain of custody log for every file.

What does your HRIS contract probably say about your data?

Data return language is rarely written in plain English, and it's rarely written in your favor. Before you can protect your data, you need to know what you've already agreed to. If you're unclear on where the line between your data and the vendor's platform sits, our explainer on what an HRIS is and who owns the data in it is a good starting point.

Pull the master service agreement, the DPA, every order form and any amendments. Search for "data return," "data portability," "termination assistance," "post-termination access" and "deletion." What you find, and what you don't, tells you most of what you need to know.

Three clauses that should worry you

1. "Data will be made available for export for [X] days following termination." Short windows are common. Once the window closes, many vendors move remaining data into a deletion process. If you haven't pulled full history by then, getting it back may be difficult or impossible.

2. "Exports are limited to the platform's standard export functionality." This sounds neutral, but the vendor defines "standard." It often leaves out custom fields, audit logs, historical workflow data and integration payloads.

3. "Termination assistance is available at current professional services rates." This is how you end up paying to retrieve your own data. Some contracts also require that bulk migration go through a vendor-approved partner. Check the rate card and any partner requirement now, while you can still negotiate.

Which HR data is hardest to get out?

Names, job titles and current pay usually export cleanly. The categories below are where teams get stuck, and they're often the ones legal and compliance need most.

Payroll history

Multi-year payroll history (gross pay, deductions, employer contributions and withholdings by pay period) is often stored in a structure that doesn't flatten neatly into a spreadsheet. Your obligation to keep it doesn't end when the contract does. Under the FLSA's recordkeeping rule, 29 CFR 516.5, payroll records must be kept for at least three years from the last entry. The IRS says to keep employment tax records for at least four years after filing the fourth-quarter return for the year, and certain records, such as those supporting qualified sick and family leave wages or employee retention credit wages, for at least six years. State rules may require more. Work out the longest period that applies to you, and extract to that horizon in a format your next system or archive can actually query.

Audit logs

Audit logs record who viewed, changed or deleted specific fields and when. They often live in separate logging infrastructure and may not be part of the standard data return. If you ever need to show who changed an employee's leave status or pay rate on a given date, perhaps to defend an employment decision, you'll need those logs. Ask for them explicitly, and confirm they include user ID, timestamp, field name, old value and new value.

Custom fields and configuration

Fields your team created, such as custom review attributes, job classification hierarchies, competency ratings or nonstandard benefit codes, are sometimes treated as configuration rather than customer data. That distinction can keep them out of the standard export, even though the values represent years of data your team entered.

Integration and API data

If your HRIS exchanged data with payroll, time and attendance, benefits carriers or recruiting tools, some of that data may exist only in the integration layer or middleware. When the connection is shut off, data that only lived in transit may not be recoverable from either side. Map each integration and decide where its history should live before cutover.

What tactics slow down data exports?

"Data hostage" is an informal term, but the practices behind it are worth planning for:

• Export limits: Some platforms cap how many records you can export per request or per day through the user interface. For a large workforce with years of history, that can turn a simple export into weeks of work, or into a paid service.
• Format restrictions: A flat CSV may be free, while the structured format your new system needs is classed as professional services.
• Preferred partner requirements: If bulk migration must go through an approved partner with ties to the outgoing vendor, speed may not be their top priority.
• Cooperation tied to payment: Vendors can withhold services over unpaid invoices. Ambiguity about "account status" can also slow export requests. Start extraction before or alongside any billing dispute, not after.

What should you do before giving notice? A 12-step checklist

Run this 60 to 90 days before formal notice. Every item gets harder afterward.

1. Read the full contract stack. MSA, DPA, order forms and amendments. List every date, window, fee and format limit tied to data return.
2. Request a data dictionary. It lists every field, table and object in your tenant. You can't audit what you haven't mapped. A vendor that won't provide one is telling you something.
3. Inventory custom fields and configuration. Note what each custom field holds and whether the standard export includes it.
4. List every integration. API, SFTP and middleware connections, what flows each way, and where that data is stored.
5. Run a test export of the employee master file. Open it. Check it against the data dictionary and note gaps.
6. Request an audit log export. Cover at least the past 36 months and confirm the fields listed above.
7. Export payroll history to your longest retention requirement. Use the federal minimums above as a floor and check state rules.
8. Get the current subprocessor list. Ask which third parties (hosting, analytics, AI, payroll engines) process your employee data.
9. Negotiate post-termination access in writing. A longer read-only window is much easier to win before notice than after.
10. Get a written deletion schedule. When and how data will be removed from production, backups and subprocessor environments.
11. Confirm your new vendor's import requirements. Agree on file formats and field mapping before you extract, so you don't pull data twice.
12. Keep a chain of custody log. Who exported what, when, from where, and where the file is stored. Treat exported files as sensitive data, because they are.

If you're also negotiating the replacement system, build these data terms into the new contract from day one. Our playbook for negotiating an HRIS SOW covers the clauses worth fighting for, and our look at the hidden cost of switching HR software explains where migration budgets usually overrun.

How do GDPR and CCPA apply when data sits with a subprocessor?

Your HRIS vendor is rarely the only company handling your employee data. Hosting providers, analytics tools and payroll engines may all process it under your contract.

GDPR. If you employ people in the EU, Article 28 of the GDPR applies to your vendor as a processor. Article 28(2) says a processor can't engage another processor without the controller's prior specific or general written authorisation. Article 28(3)(g) requires the contract to say that, at the end of the services, the processor deletes or returns all personal data at the controller's choice and deletes existing copies unless law requires storage. Article 28(3)(h) requires the processor to make available the information needed to demonstrate compliance. In practice, ask for written confirmation that each subprocessor has deleted your data too, not just the vendor's main database. For a wider view of these duties inside HR systems, see GDPR and HRMS: managing employee data privacy.

CCPA. The California Attorney General notes that the CCPA's exemptions for employment-related personal information expired on December 31, 2022. California residents, including employees, have rights to know, delete and correct personal information, and to limit use of sensitive personal information. The business remains responsible for responding to requests, and consumers can ask businesses to tell their service providers to delete data too. If copies of your data linger with a former vendor or its subprocessors, honoring a deletion request gets harder.

What should a data destruction certificate include?

A verbal "we'll delete it" isn't good enough. Ask your vendor, and each subprocessor it names, for a written certificate that includes:

• The legal name of the entity that destroyed the data
• The data categories destroyed, not just "all customer data"
• The date destruction was completed
• The method used, such as secure deletion or cryptographic erasure
• Confirmation that backups and archives were destroyed, or the date they will be
• The name and title of the person signing

Keep the certificate with your vendor file. It's your evidence that you followed through on your obligations as the data owner, and it's useful if the former vendor ever has a security incident.

What about backups?

Ending the contract doesn't delete your data on the spot. Vendors keep backups on rotation schedules, and some DPAs say backup copies will be removed "in the ordinary course of business." That can mean sensitive records, like Social Security numbers, pay history and leave data, stay on infrastructure you no longer control for months. Ask for the actual backup retention period in writing, negotiate a firm deadline, and calendar follow-ups to confirm it happened. Our SOC 2 guide for HR directors explains how to read a vendor's controls report for backup and disposal practices.

Who needs to be involved?

Data extraction isn't just an IT task. You'll need HR operations to validate completeness, legal to read the contract and confirm retention duties, information security for chain of custody, and finance to clear billing issues that could slow vendor cooperation. Name one owner, usually the HR technology lead, to run vendor communications. Treat extraction as a parallel workstream to vendor selection, not something that starts after the new contract is signed.

Frequently asked questions

Does an HRIS vendor have to give our data back?

It depends on your contract and the laws that apply. Most contracts provide some export window, though formats and fees vary. If GDPR applies, the processor contract must require deleting or returning personal data at the end of services, at your choice. Read your MSA and DPA early and negotiate anything missing before you give notice.

How long must we keep payroll records after switching systems?

At the federal level, FLSA payroll records must be kept at least three years, FMLA records at least three years, and IRS employment tax records at least four years after the fourth-quarter filing, with some credit-related records kept six. State laws can add more. The duty stays with you as the employer, whichever system holds the data.

Is deleting our data from production enough?

No. Copies can remain in backups, archives and subprocessor systems. Ask for a written deletion schedule covering all of them, and a signed certificate that names the data categories, method, date and the person responsible. Follow up at agreed checkpoints until every location is confirmed.

What to do next

• Pull your MSA, DPA and order forms this week and list every data return window, format limit and fee.
• Request the data dictionary, audit log export and subprocessor list before any renewal conversation.
• Run a test export of the employee master file and payroll history, and check both against your retention requirements.
• Draft the deletion and certificate terms you want, and raise them before you give notice.

This article is general information, not legal advice. Confirm retention and privacy duties for your jurisdictions with counsel.

Sources

• Regulation (EU) 2016/679 (GDPR), Article 28: Processor, EUR-Lex
• California Consumer Privacy Act (CCPA), State of California Department of Justice, Office of the Attorney General
• 29 CFR 516.5: Records to be preserved 3 years, Legal Information Institute, Cornell Law School
• Employment tax recordkeeping, Internal Revenue Service
• 29 CFR 825.500: FMLA recordkeeping requirements, Legal Information Institute, Cornell Law School

Last reviewed: October 2026.