If your software contracts renew on January 1, the practical right to take your data with you is being decided right now, in a clause most buyers skim. State privacy laws will not rescue a business account in most of the country. The export you get is the export your contract promised, in the format it named, during the window it set.
That is a less comfortable answer than people expect, and it is also a fixable one. Renewal is the single moment of the year when a vendor is motivated to agree to things. If you missed that moment last year, the recovery is not as bad as it looks either.
Why the fourth quarter is when this gets decided
Three calendars converge. Annual subscriptions signed in January come up for renewal in the fall, because auto-renewal notice periods typically run thirty to sixty days ahead of the term date. New state privacy statutes overwhelmingly take effect on January 1, which is when vendor legal teams refresh their standard terms. And budget cycles push buyers to sign quickly in December, which is exactly when nobody reads the data section.
So the practical sequence is: your leverage peaks in October and November, the paperwork changes in January, and the clause you did not negotiate governs for another twelve months. If you are reading this in December with a renewal already processed, skip to the last two sections. There is still work available to you.
The statutory right is real, and it probably is not yours
Comprehensive state privacy laws now operate in a long list of states, and nearly all of them include a portability right: a consumer can request a copy of the personal data they provided, in a portable and readily usable format, where technically feasible. That sounds like it solves the problem. It does not, for two reasons that vary sharply by region.
First, scope. Most state laws define a consumer as a resident acting in an individual or household context and explicitly carve out data processed in a commercial or employment context. Your CRM records, your billing history, your employee files sitting in a payroll platform: in the majority of states, those fall outside the right entirely. California is the notable outlier, having extended its regime to cover employees and business contacts rather than carving them out. A Texas company and a California company asking the same vendor the same question can get legitimately different answers.
Second, substance. Even where the right applies, it generally reaches data the person provided, not everything the system generated. Inferred scores, usage analytics, internal tags and derived fields often sit outside it. And the right belongs to the individual, not to your company, which means a portability request produces one person's records rather than the dataset your operations run on.
The Federal Trade Commission oversees unfair and deceptive practices in how companies describe and handle customer data, and it is the body that takes an interest when a vendor's marketing promises about data access do not match what the product does. That matters more than it sounds, because a specific written promise about export is enforceable in a way that a vague one is not.
The clauses that actually control your exit
Because statute mostly sits this one out, the contract is the instrument. Four provisions decide whether a migration is a weekend or a quarter.
- Format. "Export available" is not a commitment. Name the formats: CSV or JSON for records, native file formats for documents, and a stated structure for relational data such as linked contacts, deals, and notes. An export that flattens relationships into one table is technically an export and practically a rebuild.
- Scope. Specify attachments, audit logs, custom fields, archived records, and anything marked deleted but retained. Most unpleasant surprises are in attachments.
- The post-termination window. Vendors commonly hold data for a defined period after the term ends and then delete it. Thirty days is common and thirty days is tight if a dispute is running. Ask for sixty or ninety, in writing, and ask what happens if your account is suspended for nonpayment rather than terminated normally.
- Access during a dispute. A suspension clause that cuts off the interface also cuts off the export button. Carve out read and export access from suspension remedies.
If the window already closed
Start with the API rather than the account. API credentials sometimes survive an interface lockout, and even a read-only token can pull records. Then look for the data you already have outside the platform: email confirmations, accounting system records, documents your team downloaded locally, and reports that were scheduled to a shared drive. Reconstructing a customer list from invoices is ugly but fast.
Next, ask in writing and ask the right people. Billing resolution and an export request handled together move faster than either alone, and a dated written request establishes when you asked. If any of your records involve California residents, employees or business contacts included, the statutory request route is genuinely available and carries response deadlines. In other states it may not be, which is worth knowing before you spend a week on it.
What to do before you sign the renewal
Run a test export now, while your account is healthy, and open the file. Count the records. Check that the attachments came through. Note how long it took and whether anyone had to request it from support. That single exercise tells you more than any clause, and it gives you the specific sentence to add at renewal: the export you just performed, named, promised, and available for ninety days after the term ends.
Vendors agree to this more often than buyers expect, because the request is narrow and the renewal is in front of them.