The Working File Is Not the Firm's: Drafting Data Handover Before the Mandate Ends

Few commercial conversations deteriorate as quickly as the one that begins with a client asking for "the model". The request is reasonable; the timing rarely is. By the point an engagement is unwinding, the parties have usually stopped investing in each other's convenience, and a request for working files can read as a prelude to dispute rather than an administrative step.

That framing is the problem. Data portability is not fundamentally an exit negotiation. It is a design question that is best answered at onboarding, when the parties are still minded to agree.

Portability as a retention argument, not a concession

Firms tend to treat the export of working files as a cost of leaving. Reframed, it is evidence of institutional control. A firm that can produce a client's records in a usable format, on a defined timetable, with a documented assumption trail, is demonstrating something valuable: that its files are orderly, its processes are repeatable and its client relationships are not held together by friction.

That signal matters in tender processes far more than most firms assume. Prospective clients increasingly ask how they would exit, and an evasive answer is noted. Equally, a clean handover is one of the more reliable sources of onward referral — departing clients tend to speak well of advisers who made the transition straightforward, and poorly of those who did not.

The counter-risk is regulatory. A disputed handover tends to generate a data subject access request, a complaint to a professional body, or a letter before action. Each of those consumes partner time at a rate that dwarfs the cost of having drafted the clause properly in the first place.

Ownership is usually the wrong question

Contracts frequently assert that "all data" belongs to one party or the other. That formulation rarely survives contact with reality. Under UK GDPR, the client will typically be the controller of personal data relating to its own people and customers, while the firm may act as processor for some processing and as an independent controller for others — client due diligence files and internal risk assessments being the obvious examples. A blanket ownership clause either misstates the position or collapses under it.

The more workable approach is to classify rather than to claim. Four tiers are usually sufficient:

• Client records. Instructions, executed documents, ledgers, invoices, statutory filings and correspondence addressed to or issued on behalf of the client. These should transfer as a matter of course.
• Derived outputs. Models, valuations, sensitivity analyses, reporting packs and the assumption schedules behind them. Transferable, subject to carve-outs for the firm's own methodology and any third-party licences.
• Internal material. Risk assessments, credit notes, internal correspondence, fee negotiation records and anti-money-laundering files. Ordinarily withheld or redacted; money laundering records carry their own statutory retention obligations under the 2017 Regulations and cannot simply be handed over on request.
• Know-how. Templates, precedents, sector benchmarks and frameworks. Not client data at all, and should be expressly excluded.

A schedule mapping the client's anticipated outputs to these tiers, prepared at onboarding, is worth more than several paragraphs of recital.

Usable, not merely readable

Contracts that promise delivery "in an accessible format" deliver exactly what one would expect: a PDF of a spreadsheet. If the client is going to brief a successor, the export must function.

Specify formats in the schedule. Spreadsheets should be provided in native format with formulas intact where licensing permits, alongside a values-only copy and a short assumptions note explaining inputs, sources and calculation conventions. Data files should be delivered as CSV or XLSX; archival material as PDF/A. Where a vendor's licence restricts export of models built on its platform — a live and growing issue with subscription-based analytics tools — that constraint should be identified in the contract rather than discovered at termination.

Version control matters too. State the date of the export, the period covered, and whether superseded drafts are included.

Timing, and what a handover window is for

A handover obligation with no timetable is a source of leverage for whichever party is less inclined to move. Fix the sequence: an initial data map within ten business days of a written request, substantive delivery within thirty, and a migration licence running for sixty to ninety days at a defined rate so the successor can ask questions while the knowledge is still resident.

One caution on withholding. Retaining files pending payment of outstanding fees is a temptation that few firms resist well. Outside the limited lien available to certain regulated professions, withholding client records against fees is generally a contractual construct that must be expressly reserved, and even then invites a complaint about proportionality. If a lien is intended, say so, narrow it, and take advice on its enforceability in the relevant jurisdiction.

Statutory retention must also be respected on both sides. A company must keep its accounting records for three years if private, six if public, under the Companies Act 2006, and successor advisers inherit their own obligations. A handover clause that presumes immediate deletion of everything is unworkable.

Costs, deletion and surviving confidentiality

Handover within a stated scope should be included in the fee. Beyond that, publish a rate card: per-hour recovery for bespoke data extraction, per-item charges for reconstructing archived matters, and a clear statement that third-party costs are passed through at cost. Open-ended "reasonable costs" wording produces exactly the disputes it is meant to avoid.

Deletion obligations should be drafted alongside statutory retention, with a certificate of destruction available on request, a stated backup rotation period, and an honest acknowledgement that immutable archive copies may persist until the cycle completes. Promising more than the systems can deliver is worse than promising less.

Finally, confidentiality must survive termination — and should be drafted with enough breadth to cover the firm's continued use of aggregated, de-identified information in benchmarking and pricing work. That carve-out is commercially important and routinely overlooked, then argued about later.

A practical checklist

1. Data classification schedule agreed at onboarding, not at exit.
2. Named handover contacts on both sides, recorded in the engagement letter.
3. Export format and fidelity schedule, reviewed against vendor licence terms.
4. Fixed timetable with a defined migration window and support rate.
5. Fee schedule for out-of-scope extraction.
6. Carve-outs for know-how, internal risk material and statutory retention.
7. Deletion certificate template, with backup cycle disclosed.
8. Surviving confidentiality clause including the benchmarking carve-out.
9. Retention register updated on closure of the matter.
10. Notification and professional indemnity review where a handover is contested.

None of this is exotic drafting. It is the ordinary discipline of knowing what a firm holds, why it holds it and what happens when it no longer does. The firms that get this right do not merely avoid disputes; they gain a quiet advantage in every pitch where a client is weighing continuity against change.