Proposed lead: Dave Chismon for technical continuity, Jon Baines for data responsibilities, and the buyer’s solicitor for contract wording.
Draft answer framing: Make continuity and exit demonstrable before signing. Do not assume that paying for a build transfers every account, licence or intellectual-property right.
Why it matters: ICO transfer guidance addresses responsibilities across processors and subprocessors. NCSC’s secure-development guidance covers supply-chain management and operational security. These are foundations for due diligence, not a promise that a particular agency contract protects the buyer. (ico.org.uk)
Put this question to the experts:
“If the agency stops responding tomorrow, can we keep receiving calls, revoke its access and move the workflow—and what would we lose?”
A strong answer should distinguish:
- Customer records from recordings, transcripts, configuration, prompts, code and supplier-owned components.
- Client-administered accounts from agency-controlled environments.
- Rights to use and export information from rights to modify or transfer software.
- Support response commitments from actual recovery commitments.
- Return and deletion of data from retention that remains necessary or legally required.
Evidence to request: An ownership schedule, dependency list, access-revocation procedure, documented fallback, sample export and a priced handover obligation. Confirm export routes with the incumbent software vendor rather than assuming API access permits unrestricted extraction.
Follow-up: “Demonstrate switching back to the agreed fallback without deleting pending enquiries or losing access to the business number.”
Expert quote: ____________________
Sources cited on this page
- ico.org.uk ↗ico.org.uk