You outsourced payroll across several countries to one global vendor. Now you want to leave, or at least bring one country in-house, and you have discovered that the payroll history, tax filings and employee records sit in the vendor’s platform. Exports are partial, requests go unanswered, or the vendor quotes a fee to hand over “your” data. It feels like being held hostage.
The direct answer: your vendor almost certainly does not own the data in any sense that lets it refuse you, but getting it back depends on your contract, the vendor’s legal role in each country, and how precisely you ask. Start with the contract’s data, termination and exit clauses; where EU or UK personal data is involved and the vendor acts as your processor, GDPR requires it to delete or return the data at your choice when the service ends. Make a specific, written request for named records in named formats, and keep paying for payroll continuity until you have them.
Why this happens
Global payroll is usually delivered through a mix of the vendor’s own entities and in-country partners. Data lives in several places: the vendor’s platform, local payroll engines, and tax authority submissions made in someone else’s name. Exports built into the platform tend to cover what the platform displays, not the full statutory record.
There is also a commercial reason. A vendor that makes leaving hard keeps customers longer. That is not unique to payroll, but payroll data is unusually hard to reconstruct, which makes the leverage real.
First, work out which model you actually bought
| Model | Who is the legal employer | What it means for your data |
|---|---|---|
| Payroll processing | You, through your own local entity | The vendor processes payroll on your behalf. Records relate to your own employer obligations, so you have the strongest claim to them. |
| Employer of record (EOR) | The vendor or its local partner | The EOR has its own legal obligations as employer and may hold some records in its own right. You still need contractual rights to copies. |
| Mixed | Varies by country | Check country by country; this is where most confusion comes from. |
If you used an employer of record in some countries, our guide to when an employer of record is worth it explains how that arrangement divides responsibility.
What the law gives you
Contract first. Look for clauses on data ownership, return of data on termination, exit or transition assistance, formats, and fees for termination services. These usually decide the practical outcome.
GDPR, where it applies. When a vendor processes personal data on your behalf as a processor, Article 28(3)(g) of the GDPR requires the processing contract to oblige it, at the controller’s choice, to delete or return all personal data after the end of the services, and to delete existing copies unless law requires storage. Article 28(3)(h) also requires the processor to make available the information needed to demonstrate compliance. Where an EOR acts as a controller in its own right for some data, the analysis is different, which is why the model matters.
EU Data Act, for data processing services. The EU Data Act has applied since 12 September 2025 and includes rules on switching between data processing services, including export in a commonly used, machine-readable format, with switching charges to be removed entirely from 12 January 2027. Whether and how it applies to a particular payroll service is a legal question, but it is worth raising with counsel if your vendor is charging heavily to let you leave.
Your own record-keeping duties. Employers typically must keep payroll and tax records for years. In the US, for example, the IRS says to keep employment tax records for at least four years after filing the fourth quarter for the year, and longer for some credits. You cannot meet those duties without the data, which strengthens your hand.
How to get the data back
- Do not terminate first. Keep the service running until you have verified complete records. Losing payroll continuity is worse than paying one more month.
- List exactly what you need, per country: employee master data, payroll registers by period, payslips, year-to-date totals, statutory tax and social security filings and receipts, year-end certificates, leave balances, benefits and pension contributions, and termination documents.
- Specify formats: machine-readable files for data (such as CSV or XLSX with field definitions) and PDFs for filed documents.
- Send a formal written request citing the relevant contract clauses and, where applicable, the GDPR processor obligation. Set a reasonable deadline.
- Escalate to your account executive and the vendor’s data protection officer, not only support.
- Verify completeness by reconciling totals against bank payments and general ledger entries.
- Use local sources for gaps. In many countries, filed returns can be obtained from tax or social security authorities, or through the local accountant or payroll partner who filed them.
- Get legal advice if the vendor refuses or demands fees that the contract does not support.
How to avoid this next time
- Write a data return clause specifying records, formats, timelines and that exit assistance is included or capped in price.
- Require scheduled exports, such as a full payroll register and filings archive every quarter, delivered to storage you control.
- Ask for the names of in-country partners and whether you can contract with them directly on exit.
- Keep your own general ledger reconciled to payroll each month, so your books hold the totals even if the platform does not.
- Test the export during onboarding, not at termination.
The same principle applies to domestic payroll. As covered in what happens when your payroll provider’s support gets worse, the liability stays with the employer, so the records need to stay within reach too.
A hypothetical transition
A 90-person software company with employees in four countries decides to move two countries to local payroll providers. It keeps the global vendor for one more quarter, requests two years of registers, filings and year-end documents for the two countries, reconciles them to its ledger, and runs one parallel payroll with each new provider. Only after the first live month balances does it end the service for those countries.
Getting control of payroll data back
Exiting a payroll vendor is mostly careful data work: knowing what to request, checking that it is complete, and moving it somewhere you control. AB7 Solutions provides finance and accounting support that can help here, including building the country-by-country records list, reconciling payroll data to your ledger, data migration and transformation into your new systems, and ongoing payroll processing support. We are not a law firm, so where the contract or regulations are contested, we will work alongside your legal counsel.
Tell us which countries and systems are involved and what the vendor has provided so far, and we will help you plan the exit.
Email: ab@ab7solutions.com | director@ab7solutions.com
Phone: +91 9878067778 | +1 321 341 7733
Website: www.ab7solutions.com
This article is general information, not legal advice. Sources: GDPR Article 28; European Commission, Data Act explained; IRS, Employment tax recordkeeping.