A distribution company has run its operations on the same cloud platform for six years: customer records, order history, pricing, service notes, scanned documents.
Leadership decides to move to a competitor, and someone finally reads the subscription agreement. It contains one relevant sentence: "Customer retains all right, title, and interest in Customer Data." Reassuring; until they request a full export and learn that the platform offers CSV downloads of three tables, that attachments come one at a time, that a complete extract carries a five-figure professional services fee, and that account access ends thirty days after cancellation.
Nobody disputes who owns the data. The dispute is who must hand it over, in what form, and by when, and the contract says nothing about that. Owning your data and being able to get it back are different questions, and only one is usually answered in writing.
What "Owning Your Data" Actually Settles
A contractual statement that the customer owns its data answers a question of title. It does not create a duty to export, deliver, or format anything.
Four categories are worth separating.
What you put in. Records you upload or enter. Ownership is usually uncontroversial once the contract says so.
What the platform produces from your inputs. Reports, configurations, logs, audit trails. Whether these count as "Customer Data" depends on how that term is defined, and many definitions reach only what the customer submits. The vendor's platform software, infrastructure, and proprietary methods are the vendor's.
Aggregated and anonymized analytics. Most vendors reserve the right to use customer data in de-identified form for benchmarking and product development. Who owns that output is a matter of contract allocation, not a default the law supplies. Where a compiled dataset carries real value, North Carolina trade secret law may protect it, but only on a fact-specific showing of value and genuine secrecy. Compare Sunbelt Rentals, Inc. v. Head & Engquist Equip., L.L.C., 174 N.C. App. 49 (2005), with Combs & Assocs., Inc. v. Kennedy, 147 N.C. App. 362 (2001).
An ownership recital tells you who holds title. It rarely tells you who gets the bytes, in what format, on what timetable.
When the Contract Is Silent
North Carolina enforces unambiguous contracts according to their terms, and the meaning of a clear agreement is a question of law decided from the document itself. Lane v. Scarborough, 284 N.C. 407 (1973). A court implies a missing term only where it is necessary to carry out the parties' intention and plainly within their contemplation, never where it would contradict what they wrote. Applying that standard to a services contract, the Court of Appeals implied only the mechanism the agreement itself pointed toward. Shelton v. Duke Univ. Health Sys., Inc., 179 N.C. App. 120 (2006).
No North Carolina appellate decision has addressed SaaS data exit specifically, so the analysis rests on general contract principles applied to a newer context. That limitation is worth stating plainly.
The implied covenant of good faith and fair dealing does not fill the gap. It exists in every North Carolina contract, but it does not manufacture omitted terms, and exercising an express contractual right is generally not bad faith even if the motive is poor. See Cape Fear Coastal Aviation, LLC v. Air Wilmington, Inc., No. COA25-578 (N.C. Ct. App. Aug. 5, 2026) (unpublished, persuasive only). Course of dealing and performance are similarly narrow. GATX Logistics, Inc. v. Lowe's Cos., 143 N.C. App. 695 (2001).
Two points cut the other way. Documents executed toward a common end are construed together, so a data-return obligation buried in a processing addendum may inform the whole arrangement. Thermal Design, Inc. v. M & M Builders, Inc., 207 N.C. App. 79 (2010). And North Carolina authority is unsettled on whether the good-faith covenant can be breached without an independent breach, leaving room to argue against a vendor behaving destructively during an exit. But an express order-of-precedence clause is enforced as written. Silence does not favor the customer.
Getting Data Back Is Not the Same as Getting It Deleted
These are separate promises, and collapsing them is a common drafting mistake. Return or export protects continuity; deletion protects against lingering exposure. A customer with only an export right may leave a vendor holding complete copies; one with only a deletion right may lose records it needed.
Is deletion legally required? Generally only where the contract or a specific statute says so. Sectoral rules impose their own termination-stage duties when they apply; the HIPAA business associate rule requires return or destruction of protected health information where feasible, 45 C.F.R. § 164.504(e), but that is a sector-specific obligation written into a particular contract, not a general right. A deletion certificate is likewise negotiated, not universal.
Backups deserve realism. Most vendors cannot surgically remove one customer's records from rolling backup media, which is why workable clauses commit to deletion from active systems plus expiration from backups on a stated cycle, extend to subprocessors, and carve out time-limited retention where law requires it.
If the Vendor Withholds or Destroys Your Data
Breach of contract is the starting point, and it requires an obligation to breach, which returns you to the contract language.
Damages are harder to prove than most clients expect. Lost profits must be shown with reasonable certainty, not speculation. Iron Steamer, Ltd. v. Trinity Rest., Inc., 110 N.C. App. 843 (1993). The standard does not demand absolute certainty; Plasma Centers of Am., LLC v. Talecris Plasma Res., Inc., 222 N.C. App. 83 (2012), but reconstruction cost is often the more provable measure. Expect a mitigation defense if you ignored an available export window.
Court orders are available but not routine. An injunction to stop imminent deletion is realistic, since harm estimable only by conjecture supports irreparability. A.E.P. Indus., Inc. v. McClure, 308 N.C. 393 (1983). An order compelling a vendor to produce or restore data is a mandatory injunction disfavored, and granted only where the injury is immediate, pressing, and clearly established. Bd. of Light & Water Comm'rs v. Parkwood Sanitary Dist., 49 N.C. App. 421 (1980). The practical lesson: data that still exists but is inaccessible is a far better posture than data destroyed. Act before termination.
Two claims beyond breach matter. A vendor's conduct may support a claim under North Carolina's Unfair and Deceptive Trade Practices Act, N.C. Gen. Stat. § 75-1.1, which carries treble damages and fee-shifting, though simple breach is not enough and substantial aggravating circumstances are required. And whether withheld electronic data supports a conversion claim is unsettled here, though the Business Court has declined to rule the theory out on facts resembling a hosted-data lockout.
Liability caps usually hold. North Carolina enforces negotiated limitations between commercial parties, including in pure services contracts, and a SaaS agreement is a services contract governed by common law, not UCC Article 2. See Severn Peanut Co. v. Indus. Fumigant Co., 807 F.3d 88 (4th Cir. 2015). So a cap and a consequential-damages waiver will often blunt a data-loss claim, which is why customers negotiate carve-outs for data, confidentiality, and security obligations.
One scenario causes more disputes than cancellation: suspension over an unpaid or disputed invoice. North Carolina authority favors vendors here: conditioning performance on payment of a past-due bill did not establish a prima facie good-faith breach absent improper motive or harm. Heron Bay Acquisition, LLC v. United Metal Finishing, Inc., 245 N.C. App. 378 (2016). The customer's protection is contractual: escrow of disputed amounts, no suspension during a good-faith dispute, preserved export access throughout.
Do Privacy Laws Help a Business Retrieve Its Data?
Mostly not. State consumer privacy statutes grant rights to natural persons, not to business entities over commercial account data. California defines "consumer" as a natural person who is a California resident. Cal. Civ. Code § 1798.140. Virginia is more explicit: a consumer is a natural person acting in an individual or household context, expressly excluding anyone acting in a commercial or employment context. Va. Code § 59.1-575. Colorado's structure is the same.
So even the portability rights these statutes create belong to individuals and cover their personal data, not your CRM records or transaction history. These regimes govern how a vendor handles personal data within your account and may require return-or-delete terms in a processing addendum. They are not a mechanism for a company to retrieve its own commercial dataset. Nor is there a federal omnibus portability right; federal privacy law is sectoral.
If the Vendor Goes Out of Business
Do not assume you can simply retrieve your data from a failing provider.
Bankruptcy Code § 365(n), which protects intellectual property licensees when a debtor rejects a contract, likely does not guarantee continued SaaS performance: it is keyed to a closed statutory definition of intellectual property, and a subscription may be a pure service rather than an IP license. The Fourth Circuit has applied § 365(n) robustly, but to patent licenses. Jaffe v. Samsung Elecs. Co., 737 F.3d 14 (4th Cir. 2013).
Hosted data is also not automatically recoverable. Turnover under § 542 runs property to the estate, not from the debtor to customers, and recovery typically depends on a state-law interest such as a constructive trust. A release triggered solely by the vendor's bankruptcy may be an unenforceable ipso facto clause.
That leaves practical protections rather than legal ones: routine independent exports on your own schedule, continuity planning, transition assistance, and for mission-critical systems, a data or source-code escrow, with a neutral agent holding deposited materials released on defined triggers. Its usefulness depends on what is deposited, how current it is, and whether the triggers reach events other than bankruptcy. Because the § 365(n) treatment of SaaS is unsettled, escrow strengthens your position without guaranteeing recovery.
What Your SaaS Agreement Should Address
The right provisions depend on your business, the importance of the data, and your negotiating leverage. None is legally required; their value is displacing the default that silence creates.
Customer Data defined: stating whether it reaches outputs and derivatives.
Scope of export: what is actually available, including attachments and history.
Format and usability: platform-agnostic, not just the vendor's native structure.
Retrieval window: how long access continues after termination.
Assistance and fees: stated in advance, not quoted at exit.
Retention and deletion deadlines: with notice before vendor-initiated deletion.
Backups and subprocessors: realistic cycles, extended to third parties.
Deletion certification: where sensitivity warrants it.
Access during disputes: export rights preserved through suspension.
Continuity: escrow or equivalent for mission-critical data.
Vendors benefit from the same clarity: well-drafted retention and deletion terms limit a provider's exposure, set defensible timelines, and keep exit disputes out of litigation.
Before You Sign the Next One
Data-exit planning belongs at the front of a SaaS relationship. The leverage to negotiate an export format, a retrieval window, and a deletion process exists while the vendor is still competing for your business, and largely disappears the day you give notice.
Isaboke Law Firm advises businesses on SaaS agreements, data-return and deletion provisions, and related commercial technology contracts for customers protecting access to essential records, and for vendors drafting terms that reduce disputes. If you are negotiating a new subscription or planning an exit from a current one, we are glad to review what your agreement actually requires.
This article is for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. Outcomes depend on the specific contract language, the governing law, and the particular facts.
