Leaving a QHSE System: Data Export and EU Data Act Switching

This guide covers the exit side of a QHSE software contract: what has to leave the old system, how long those records must be kept, and what Chapter VI of the EU Data Act asks of a cloud provider when a customer switches. We read the Regulation on EUR-Lex, and the Commission's guidance on its own site, on 21 October 2026. It is general information, not legal advice.

The short answer

Treat leaving as a records project with a contract deadline. List what the old system holds, run a full export long before notice, check that it opens without the old vendor's software, and keep it for as long as the law asks, which for some health records is decades.

The Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025 to cloud services sold to customers in the Union. Its Chapter VI makes the provider write the exit rules into the contract: notice to start a switch capped at two months, a hand-over phase capped at 30 calendar days, a retrieval window of 30 days or more, an exhaustive list of what can be exported, and erasure at the end. From 12 January 2027 the provider may not charge for the switching process; until then, only its directly linked costs. Of the 212 vendor profiles we research, 4 record what can be exported at exit, 11 a deletion or retention rule and 4 a data processing agreement.

What has to leave the old system

A QHSE system holds more than rows in a table. The export has to keep each record tied to its history, its files and the people who acted on it.

Our reading of the Regulation, not a ruling: "exportable data" covers input and output data, including metadata generated by the customer's use of the service (Article 2(38)). That is where records, attachments and much of an audit trail sit. The Commission's FAQ counts the configuration of settings and access rights among digital assets (Article 2(32)), which move only where the customer has a right to use them apart from the old contract. Neither text names form templates, so ask for the contract's list of exportable data to name them. For what vendor records say about history and version control, see audit trail and document control and document control.

How long the records must outlive the contract

The contract ends; the duty to keep the records does not. Examples from the texts we read:

• United States. 29 CFR 1904.33 keeps the OSHA 300 Log, the privacy case list, the annual summary and the 301 incident reports for five years beyond the calendar year they record. During those five years the stored 300 Logs must still be updated when a case is found or reclassified, so the archived log has to be a copy you can still change. Unless a specific standard sets another period, 29 CFR 1910.1020(d) keeps employee exposure records for at least 30 years and medical records for the length of employment plus 30 years. It leaves the form to the employer, provided the information stays preserved and retrievable. See OSHA 300.
• Great Britain. Regulation 12 of RIDDOR 2013 keeps each entry in the record of reportable incidents and diagnoses, and of over-three-day injuries, for at least three years from the date it was made. Regulation 11(3) of COSHH 2002 keeps a health surveillance record for at least 40 years from its last entry. See RIDDOR and COSHH.
• Personal data. Article 28(3)(g) of the GDPR has the processor delete or return all personal data at the end of the services, as the controller chooses, unless Union or Member State law requires storage. Ask for the return first and the deletion second, in writing. Our page on cloud and on-premise deployment covers the processor contract.

The consequence is the format. An export that opens only in the old vendor's software is not a record you can keep for 40 years. Ask for a structured format that ordinary tools can read, and test it.

What the Data Act asks of the provider

Who it covers

Chapter VI binds providers of data processing services, wherever they are established, that serve customers in the Union (Article 1(3)(f)). Article 2(8) defines such a service by cloud traits: network access on demand to a shared pool of configurable, scalable and elastic computing resources, provisioned and released with little effort or contact with the provider. Recital 81 lists software as a service among the delivery models. The Commission's FAQ (version 1.4, 22 January 2026, question 58a) says the chapter covers any SaaS that shows those traits, and that it matters whether the customer uses the service as such or only a function it enables.

Two exceptions in Article 31 can reach a QHSE product.

• Custom-built services. Where most main features were built for one customer and the service is not sold at broad scale from the provider's catalogue, Articles 23(d), 29, 30(1) and 30(3) do not apply. The rest still does: FAQ question 52 names open interfaces and export in a structured, machine-readable format.
• Trials. The chapter does not apply to a non-production version supplied for testing and evaluation for a limited time.

A provider relying on Article 31 must say which duties do not apply before the contract is signed (Article 31(3)). Software you install and run on your own servers is not, in our reading, a data processing service, so its exit depends on the licence.

Contracts signed on or before 12 September 2025. Article 50 gives Chapter VI no start date of its own, and the FAQ we read does not discuss older contracts for this chapter. On 19 November 2025 the Commission proposed a Digital Omnibus, COM(2025) 837. For non-IaaS services under contracts concluded on or before 12 September 2025, it would lift Article 34 and all of Chapter VI except the Article 29 rules on charges, in two cases: services largely adapted to one customer, and services from providers that are small and medium-sized enterprises or small mid-caps. It would also confirm that fixed-term contracts may carry proportionate early termination penalties. On 21 October 2026 the Parliament's Legislative Observatory showed the file as awaiting a committee decision, so none of this is law. That the Commission proposed a carve-out for older contracts suggests it reads them as covered today; that is our inference.

What the contract has to say (Article 25)

When the notice period ends, the customer tells the provider whether it is moving to a named new provider, to its own infrastructure, or only wants its data erased (Article 25(3)).

Our arithmetic with the outer limits: two months of notice plus 30 days of transition put the cut-over about three months after notice, and retrieval runs for at least another 30 days. A plan that assumes the old system is gone a fortnight after notice does not fit those limits, so read the actual periods in your contract.

Formats and interfaces (Articles 26 and 30)

The provider must explain how switching works, which methods and formats exist and which limits it knows of, and point to an up-to-date online register of the structures and formats of the exportable data (Article 26). Providers other than pure infrastructure services must offer open interfaces free of charge, on equal terms to every customer and to the receiving provider (Article 30(2)). Until common specifications or harmonised standards exist for the service type, the provider exports all exportable data on request in a structured, commonly used and machine-readable format (Article 30(5)).

The duty stops at the old provider's door. Functional equivalence applies only to infrastructure services (Article 30(1)), and FAQ question 58b says no source provider has to help the customer rebuild the service at the new provider. Recital 85 gives extraction to the old provider and the upload to the customer and the new provider, unless a transition service is bought. Budget the import, the field mapping and the checks as your own work.

Charges (Article 29)

• Until 12 January 2027 a provider may impose reduced switching charges, capped at the costs directly linked to that switch.
• From 12 January 2027 it may impose none for the switching process.
• Switching charges include data egress charges but exclude standard service fees and early termination penalties (Article 2(36)). Recital 89 allows fixed-term contracts with proportionate early termination penalties, and paid extra work that the customer asks for beyond the provider's duties, priced in advance.
• Before the contract, the provider must state its standard fees, the early termination penalties it might impose and the reduced switching charges it might apply until 12 January 2027 (Article 29(4)), and must flag services where switching is highly complex or costly (Article 29(5)).
• Keeping two services running side by side as a standing set-up is in-parallel use, not switching, and cost-based egress charges may continue there after 12 January 2027 (Article 34(2); FAQ question 54).

If your switch will run across 12 January 2027, ask in writing how charges for work after that date will be treated. The pricing guide has exit questions you can copy into a quote request.

Contract wording

On 19 November 2025 the Commission published non-binding standard contractual clauses for cloud computing contracts; its page, last updated on 3 March 2026, still titles the recommendation a draft. Three of the six clauses turn Chapter VI into contract text: switching and exit, termination, and security and business continuity during the switch. Read them beside a vendor's own terms. The RFP template has an exit and data-portability section to send before you sign.

What 212 vendor profiles record about exit

The figures below count what the 212 researched vendor records say on these three points. The records were read from 28 September to 14 October 2026, and the counts are the ones our hosting and data location study publishes. A missing statement means we found none in the record, not that the product lacks the term. Exit terms may sit in a contract or order form that the record does not include.

Only 1 profile records both an export at exit and a deletion rule. Of the 73 records that describe a cloud or SaaS delivery without naming the tenancy, 65 carry none of the three statements.

In our reading of the quoted words, the 4 exit statements differ in kind: one describes an export at cancellation, one a download window of a stated number of days after termination, one an export the customer may request after termination and before deletion, and one an extraction the vendor carries out in named file formats. Of the 11 deletion or retention statements, 2 concern data after the subscription ends; the others cover trial data (2), visitor records (3), generated export files (1), inactive accounts (1) and retention periods (2).

Counting rule: a statement counts only when the record's own words support it, and the study's generator stops when quoted words leave a record. These counts are a floor. None of them says that a product meets or fails the Data Act, none ranks a product, and we tested no export. See the methodology for how the profiles are researched.

Disclosure. One of the 212 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other and is counted in every figure above like any other profile. It is not named in this article.

An exit checklist for QHSE data

Check four details that a quick export can lose: the time zone of each timestamp; the identifiers that tie an action to its incident or audit; the signing history behind a signed form, which an image of a signature does not carry; and users who left long ago but still appear in old records. The implementation guide covers the other side, bringing data into a new system, and the alternatives pages set each product's record against candidates with related capabilities.

What we could not verify (21 October 2026)

• We tested no export, read no vendor contract and asked no vendor how it applies Chapter VI. The counts above are statements in public material.
• Whether your QHSE product counts as a data processing service, and whether your organisation is a customer in the Union, are legal questions. The FAQ and the Commission's "Data Act explained" page both say they do not represent the Commission's official position.
• Whether Chapter VI reaches contracts concluded on or before 12 September 2025: neither Article 50 nor the FAQ we read says so directly.
• The Digital Omnibus may change before adoption. We read the Commission's proposal and the procedure page, not the committee draft report of 22 June 2026 or the amendments tabled on 27 July 2026.
• The FAQ is a PDF, so we read version 1.4 as extracted text rather than in a browser. Its answer on the contractual clauses (question 58) was written before they were published.
• Retention rules differ by country and sector; we read only the US and British examples above. We did not read national rules on enforcing the Data Act or on penalties.

FAQ

Does the EU Data Act apply to QHSE software?

It can. Chapter VI binds cloud providers that serve customers in the Union, and the Commission's FAQ says software as a service with the cloud traits of Article 2(8) is included. Custom-built services and time-limited trials get a lighter regime or none. Ask the vendor in writing and take legal advice.

When do switching charges end?

From 12 January 2027 a provider may not charge for the switching process. Until then it may charge only the costs directly linked to the switch. Standard service fees and early termination penalties are not switching charges.

How long do I have to get my data out?

Article 25 sets a retrieval period of at least 30 calendar days. It starts after a transition of at most 30 days, which follows a notice period of at most two months. Your contract sets the actual periods.

Will the old vendor load my data into the new system?

Not under the Data Act. The old provider must support the exit and export in a structured, machine-readable format; the import belongs to you and the new provider, unless you buy a transition service.

Sources

Read on 21 October 2026.

• EUR-Lex: Regulation (EU) 2023/2854, the Data Act (Articles 1, 2, 23 to 31, 34, 41 and 50; recitals 78 to 98), its document page (corrigenda only, one amending proposal), Digital Omnibus proposal COM(2025) 837, GDPR, Article 28
• European Parliament: Legislative Observatory, procedure 2025/0360(COD)
• European Commission: Data Act (last update 2 July 2026), Data Act explained (15 December 2025), FAQ page and FAQ version 1.4 (PDF), model terms and standard contractual clauses
• OSHA: 29 CFR 1904.33, 29 CFR 1910.1020
• legislation.gov.uk: RIDDOR 2013, reg. 12, COSHH 2002, reg. 11
• The QHSE Standard: the hosting and data location study and the hosting statements behind its counts