What should the contract and handover protect?

• Scope and acceptance: exact workflows, exclusions, test cases, acceptance authority and payment milestones.
• Operating responsibility: who monitors failures, clears queues, changes scripts and authorises new actions.
• Support: covered hours, severity definitions, response commitments, restoration responsibilities and escalation contacts.
• Changes: included changes, chargeable work, model/provider substitutions and regression testing.
• Costs: charging units, allowances, overages, price-change notice, spending limits and behaviour when limits are reached.
• Accounts and numbers: client control where practical; otherwise documented tenant access, number-transfer arrangements and an executable exit process.
• Configuration and intellectual property: rights to business-specific scripts, mappings, documentation and custom code, distinguishing these from reusable supplier components.
• Data: export formats, retention, deletion, incident assistance, rights-request support and subprocessor changes.
• Liability and insurance: responsibility for foreseeable errors and evidence that the proposed activity falls within relevant cover; do not infer coverage from a certificate alone.
• Exit: notice, fees, transition period, knowledge transfer, credentials revocation and a successful export rehearsal.

ICO guidance requires relevant processor contracts to provide for return or deletion of personal data at the controller’s choice, with deletion of copies unless UK law requires storage. Negotiate workflow documentation, configuration and code rights separately; a personal-data export is not the complete operational handover this scorecard requires. (ico.org.uk)