Your company runs on a SaaS tool every day. It may be a job-order system, accounting software, a CRM or a booking tool. Then the provider emails to say it is closing. The questions follow at once: can we get years of customer data and job history back, who is responsible during the changeover, will prepaid money come back, and what does the contract we signed actually give us?
This guide is written from the buyer's side. Read it with our guides on SaaS pricing models and subscription contracts, software development contracts and source code and MSA and SLA monthly service contracts. If an admin account or domain sits with someone who has left, see when an employee or agency will not return the Facebook page, LINE OA and domain.
The short answer
When a shutdown is announced, do three things in order: export all your data first; then use the contract to demand what the provider still owes, such as a transition period and a deletion confirmation; and only then deal with refunds and damages. Getting your data back affects the business faster than getting money back ever will.
The legal basis. The relationship is governed by the contract, which is read in good faith with regard to ordinary usage (Civil and Commercial Code Section 368). If the provider fails to perform, the company may rescind and require restoration to the former position under Sections 386 to 391, and claim damages under Section 222. Where the data includes personal data, the company is the controller with duties under Personal Data Protection Act B.E. 2562 Section 37, and the provider as processor has duties under Section 40.
Our practical view. The problem is rarely that the law gives no right. It is timing and evidence. A closing provider usually cuts support first and may switch the system off sooner than announced. Finish your own copy of the data before negotiating anything else.
Hypothetical. An air-conditioning repair and installation company in Khon Kaen (we call it "the AC company") uses a SaaS tool to dispatch technicians and store customer equipment histories and site photos, three years of records. The provider announces it will close in 60 days and will disable exports 14 days before that. This example runs through the guide.
1. What do we do in the first 72 hours?
Do not wait until the legal answer is complete. Do the irreversible things first.
- Read the contract and the notice. Find the real closing date, the date exports stop, the termination terms and any wording on customer data. Keep the announcement email as evidence. Do not accept or sign documents the provider sends without reading them, as they may contain a waiver.
- Export everything now. Use the system's export function and, if there is an API, pull a second copy. Store it somewhere the company controls, not only in one employee's mailbox.
- List what lives only in the system. Edit history, attachments, comments, templates, scheduled reports and user permissions. Exports are often incomplete.
- Appoint one owner and a backup, as the single contact for the provider and the person who reports to management.
Hypothetical. The AC company exports on day one and finds the file has customers and job orders but no photos and no edit history, so it asks the provider in writing to supply those separately.
2. What should the contract give us? (use it to check the old contract and draft the new one)
If the old contract lacks any of these, ask for them in a transition agreement. If you are choosing a new system, put them in before signing.
| Topic | What to write |
|---|---|
| Data ownership | Data entered by the company and its customers belongs to the company; the provider uses it only to deliver the service |
| Export right | Export at any time, all data types, in a usable format such as CSV, JSON or original files, with a description of the data structure |
| Transition period | Read and export access continues for a set time after service ends |
| Assistance services | The provider helps with export and migration questions, stating whether this is charged |
| Deletion and certificate | Deletion within a set time, including backups, with a written deletion certificate |
| Escrow for critical systems | Source code or environment deposited with a third party, released if the provider ceases business |
| Notice of discontinuation | A notice period long enough to migrate |
| Refund of prepaid fees | The unused portion is refunded if the provider ends the service |
The law sets no fixed figures for these; they are agreed according to how critical the system is. If the contract is silent, rely on good-faith interpretation under Section 368, but it is better to put it in writing than to argue later.
3. If the provider breaches, can we rescind and claim damages?
Closing mid-term without the company's consent may be a failure to perform. The company can insist on performance, which is usually impossible once the system is off, or rescind.
- Rescission under Sections 386 to 391, where there is a right to rescind under the contract or the law. In some cases a reasonable period for performance must be set first (Section 387). Give notice in writing.
- Restoration. On rescission each party returns what it received. The provider returns unused prepaid fees; the company stops using the service and returns what it must.
- Damages. Rescission does not remove the right to damages (Section 391). These depend on provable loss such as migration costs and the labour of re-entering data, and on any liability cap in the contract. The company's own fault may reduce damages under Section 223.
The caveat is that these rights do not always produce money. If the provider is out of funds or insolvent, see section 5.
4. PDPA: the company is the controller, the provider the processor
In a SaaS tool holding customer, employee or contact data, the company is usually the controller and the provider the processor. That cuts both ways.
- Controller duties (Section 37). Put measures in place to prevent the processor using or disclosing data unlawfully, and erase or destroy data when the retention period ends or it is no longer needed. Leaving data in a dead system with no idea what happens to it is the company's own risk.
- Processor duties (Section 40). Act on the controller's instructions, maintain security measures and notify the controller of a breach. That gives the company a basis to require return and deletion.
Ask in writing: return first, then delete, including backups and sub-processors, and ask for a written confirmation. Deletion must be verifiable. If data leaks during the shutdown, see first steps in a data breach, and the PDPA compliance checklist.
5. What if the provider is insolvent or has no money?
If the provider is sued in bankruptcy or is restructuring, treat the situation with extra care.
- Prepaid fees and damages are claims to be submitted through the bankruptcy process. You may recover part or recover late, not immediately.
- Access to the data may depend on whoever is appointed to deal with the provider's assets, so write to that person asking to export the company's data.
- The company's own data should not count as the provider's assets, but in practice you need evidence of what is whose.
This depends on the facts and on the court. Take advice before filing a claim, because the bankruptcy process has statutory deadlines.
6. How do we choose and move to a replacement?
- Test with real data. Import the exported data and check that fields, dates and attachments are complete.
- Compare contracts. Check the section 2 points before signing, and that the new provider is reasonably sound financially.
- Run in parallel for a short period before switching the old system off.
- If personal data is involved, sign a data processing agreement with the new provider and inform the people concerned as needed. See company AI policy and customer data if the new tool uses AI.
7. Who inside the company holds the admin accounts and API keys?
Many companies find the admin account sits in a departed employee's name, or an API key is embedded in another system nobody remembers. Make the primary admin account use a company email, give at least two people admin rights, keep a list of API keys and connected systems, and rotate or revoke keys tied to the old system once migration is done. For handover practice see the director resignation handover checklist.
Sample table: each data or work item
| Item | Where it lives | Export format | Owner | Deadline |
|---|---|---|---|---|
| Customer and contact list | SaaS system | CSV | Sales manager | Within 72 hours |
| Job orders and service history | SaaS system | CSV or JSON | Head technician | Within 72 hours |
| Photos and attachments | Provider's file storage | Original files with a file-name list | System admin | Week 1 |
| Quotations and invoices | SaaS system | PDF and CSV | Accounts | Week 1 |
| Edit history and comments | SaaS system | Request separately from provider | System admin | Before exports close |
| User permissions and admin accounts | SaaS system | Screenshots and a list | System admin | Week 1 |
| API keys and integrations | SaaS system and connected systems | List and connection method | System admin | Week 1 |
| Data deletion certificate | Provider | Written certificate | Primary owner | After migration |
Sample request for data export and transition assistance
Subject: Request for data export and transition assistance before service ends
To: [Provider name]
Referring to your notice of discontinuation dated [date] and the service
agreement dated [date], [Company name] asks that you:
1. Export all of the company's data in the system, namely [list of data], in
[CSV/JSON/original files] with a description of the data structure, by [date].
2. Keep read and export access open until [date].
3. Assist with migration, giving the contact person and any charges (if any)
in writing.
4. Once we confirm we have received the data in full, delete all data including
backups, and issue a written deletion certificate.
5. State how unused prepaid fees will be refunded, by [date].
This letter does not waive any of the company's rights or claims.
Company contact: [name, position, email, telephone]
Yours faithfully,
[Name, position]
Checklist: when a SaaS provider announces it is closing
First 72 hours
- Keep the announcement email, read the contract and note the closing and export-cutoff dates
- Export every type of data and store it where the company controls it
- List what exists only inside the system
- Appoint a primary owner and a backup
Arrangements with the provider
- Send a written request for export and a transition period
- Agree assistance services and any charges
- Ask how prepaid fees will be refunded
- Do not sign any waiver without review
Personal data and risk
- Require return then deletion, and ask for a written deletion certificate
- Check for sub-processors or backup copies
- If the provider is in financial trouble, take advice on filing a claim
Migration
- Test an import of real data into the new system
- Compare the new contract against section 2
- Move admin rights and API keys, then revoke the old ones
Further reading
- SaaS pricing models and subscription contracts — check termination and renewal terms before signing
- Software development contracts and source code — where you need source code or escrow
- MSA and SLA monthly service contracts — write service levels and exit rights clearly
- PDPA compliance checklist — the controller's duties in overview
- First steps in a data breach — if an incident occurs during the shutdown
- Director resignation handover checklist — handing over admin accounts and access
We review existing SaaS contracts, draft letters to providers, prepare new contracts and set up PDPA practices to fit your business. For an initial consultation, call +66 92 254 2045 or send us the details. See also PDPA and data protection and contracts and business documents.
This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.
