Your SaaS terms may contain a sentence like this: \u201cAfter termination of the agreement, the Customer\u2019s data will be deleted within 30 days.\u201d It sounds prudent. Since September 12, 2025, it has been incompatible with the switching procedure described in Chapter VI of the EU Data Act<\/a>\u2014and it may be the smallest problem in your contract package.<\/p>\n Chapter VI requires providers of cloud and SaaS data processing services to support a multi-stage process when a customer switches providers. The notice period can be up to two months, followed by a transitional period of up to 30 days with full service continuity. After migration, the customer must have at least 30 days to retrieve exportable data. A typical data processing agreement, meanwhile, may require deletion \u201cno later than 30 days\u201d after termination. The two documents can point in opposite directions.<\/p>\n For a business selling SaaS in Poland, the main risk may therefore lie not in the terms alone, but in the clause that says which document prevails when the terms and the data processing agreement conflict. This article examines that issue alongside the switching timeline, fees, liability provisions, security promises, and operational decisions that the documents must reflect.<\/p>\nThe concepts that matter<\/h2>\n
| Term<\/th>\n | Meaning in this article<\/th>\n<\/tr>\n<\/thead>\n | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Data processing service<\/strong><\/td>\n| A cloud or SaaS service in which the provider stores and processes customer data on its infrastructure, typically through a subscription model.<\/td>\n<\/tr>\n | Switching<\/strong><\/td>\n | The process by which a customer moves data and digital assets to another provider or to its own infrastructure.<\/td>\n<\/tr>\n | Transitional period<\/strong><\/td>\n | The period following notice during which the provider maintains full service continuity so the customer can migrate.<\/td>\n<\/tr>\n | Exportable data<\/strong><\/td>\n | Customer-entered data subject to export, as distinct from the provider\u2019s reference data and internal data.<\/td>\n<\/tr>\n | Digital assets<\/strong><\/td>\n | Digital elements, including applications the customer is entitled to use independently of its contract with the current provider.<\/td>\n<\/tr>\n | Unfairness test under Article 13<\/strong><\/td>\n | A test for certain unilaterally imposed business-to-business contract terms. A term that grossly departs from good commercial practice and is contrary to good faith does not bind the other party.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n | Do not combine two different portability rights into one clause.<\/strong> Article 20 of the EU General Data Protection Regulation (GDPR) concerns a natural person\u2019s right against a controller of personal data. Chapter VI of the Data Act concerns a customer\u2019s rights against a data processing service provider. The right holder, legal basis, and provider obligations differ. A single \u201cdata portability\u201d clause that treats both provisions as one mechanism is a flawed starting point.<\/p>\n Many SaaS templates either omit the Data Act or offer only a sentence promising an export in a machine-readable format. That does not cover the procedure addressed by Article 25.<\/p>\n The following is the timeline the approved analysis says SaaS terms should reflect from September 12, 2025:<\/p>\n The distinction between giving notice<\/em> and completing the exit process<\/em> is essential. Even with a shorter notice period chosen by the customer, a 30-day transition followed by at least 30 days for retrieval cannot be reconciled with an unconditional promise to delete everything within 30 days of termination. The seven-day deletion notice in the table is a contractual design choice<\/strong>, not presented here as a separate statutory deadline.<\/p>\n Which providers need to address this?<\/strong> The source analysis covers B2B SaaS and cloud providers that offer a commercial product through a service catalog. It states that the Article 31 exception concerns non-production versions made available for limited-time testing. On that analysis, if a customer enters real data into a trial, the exception does not apply merely because the trial is free. Recital 98 provides relief from certain obligations for services developed to order for an individual customer; a standard SaaS product sold through a website is not the example the source treats as qualifying.<\/p>\n \u201cCustomer data will be deleted within 30 days\u201d does not specify how a customer requests a switch, how notice works, what happens during transition, when data remains available for retrieval, or how the customer exercises the right to extend the transitional period. Article 25(2) calls for a procedure, not simply an end date for storage.<\/p>\n Without an exportable-data catalog, a customer may seek the provider\u2019s licensed reference material\u2014such as sanctions lists, registers, or dictionaries\u2014alongside its own data.<\/p>\n Define the export scope and exclusions. The source proposes identifying customer-entered data as exportable, setting out formats such as XLSX or CSV, JSON for APIs, and PDF for reports, and excluding internal application data and reference databases licensed to the provider.<\/p>\n The source identifies information under Articles 24 and 26 that should be available outside the terms: a register of exportable-data structures and formats; migration procedures and known technical limitations; and information about the jurisdiction of the IT infrastructure and measures to prevent third-country authorities<\/a> from accessing non-personal data stored in the EU.<\/p>\n A separate web page or document, referenced by the terms, can carry this information.<\/p>\n If a trial permits real customer data, check both the switching terms and the personal-data documentation. The source describes a common gap: trial data appears in neither the data processing agreement nor the privacy policy<\/a>, leaving its deletion deadline undefined. It recommends extending the procedure to free-of-charge contracts, with separate, shorter deadlines.<\/p>\n A customer may ask to switch without saying whether it wants an export, a transfer to its own infrastructure, or deletion only. Without a rule for missing information, the provider may not know which process or deadlines to apply.<\/p>\n One proposed drafting solution is to give the customer a specified number of days to clarify the request and state that, if it does not, the request will be treated as a deletion request. The number of days\u2014\u201cX\u201d in the proposed clause\u2014must be chosen and written into the contract.<\/p>\n |