Reversibility clause: what it must guarantee for a website or a tool

Reversibility is prepared before you sign, which is why it belongs to the Organisation area: what you will be able to get back depends on what was written at the start, in the requirements document and then in the contract.

What the clause must settle

A reversibility clause is specific to IT contracts: hosting, managed services (handing the running of your IT to a third party), software rented online. It sets out how the client gets its data back at the end of the contract to use it elsewhere. A contract without one carries two risks: data returned in a format no other tool can read, and a client who stays because it cannot leave.

Public frameworks show the standard to aim for. SecNumCloud, the framework used by ANSSI, the French national cybersecurity agency, to qualify cloud services, requires a clause that lets the client recover all its data, both what it supplied and what the service produced, as files in documented formats or through documented interfaces, usable outside the service. In the United States, NIST asks for an exit strategy to be planned from the start, including in case the provider goes bankrupt, and calls the ability to export all your data in a usable format, in good time, vital.

In its recommendations on cloud computing, the CNIL, France’s data protection authority, proposes a model clause: on request, at any time and for whatever reason, a copy of all the data without delay, in the format in which it was supplied or, failing that, in a structured, commonly used format.

A useful clause answers five questions:

• What do you get back? The data, but also the access, the code, the content and the documentation.
• In what format? One that other tools can read, not an in-house export.
• How fast, counting from your request?
• With what help? The outgoing supplier assisting the new one during the changeover.
• At what cost? It is set in advance. An unusually high exit cost is there to discourage you from leaving.

Drafting the clause is a lawyer’s job. This guide sets out what it must cover technically, so that it works on the day you need it.

What a generic clause forgets about a website

A clause written for data hosting doesn’t cover everything that makes up a website. Three points need to be named.

First, the domain name and the accounts. For Afnic, which runs .fr domains, the holder of a domain name is whoever is listed as such in the Whois database, and that is who holds the rights; Afnic itself describes the case of a supplier who registered a name in its own name instead of its client’s. The holder can get the code needed to move to another registrar free of charge, at any time, and the transfer goes through in eight days if the old registrar doesn’t respond, or twenty-two if it objects. The change of registrar itself is usually paid for.

For .com and other generic extensions, ICANN requires that code to be handed over within five days, even in a payment dispute with the registrar, and points out that paying someone to register a name is not the same as buying it: a developer may have registered it with their own details.

The accounts for your tools raise the same question. Without administrator access, recovering a Google Analytics account means proving that you own the site, and no recovery procedure currently exists for Google Tag Manager. If these are in the name of whoever built the site, the clause must organise their transfer; if they are in your name from the start, there is nothing to transfer.

Second, the rights in what was created. Under French law, commissioning a site does not transfer the copyright in it (Article L111-1 of the Intellectual Property Code), and every right assigned must be listed separately in the contract (Article L131-3). Software written by an employee in the course of their duties belongs to their employer automatically (Article L113-9); that rule doesn’t apply to an outside supplier, for whom the written assignment is what counts. Getting the code back without the right to change it is of little use.

Finally, the documentation. Code handed over without explanation takes longer to pick up, and so costs more: the clause must say what is documented, and in what form.

What the EU Data Act changes

The EU Data Act has applied since 12 September 2025 and governs switching between cloud service providers. Its Article 25 requires the contract to set a notice period of two months at most, a transitional period of thirty days at most, at least thirty days to retrieve the data, and a list of all the categories of exportable data. Its Article 29 bans all switching charges from 12 January 2027, and the European Commission specifies that this also covers data egress charges. Where no common standard exists for the service, the provider must, at the customer’s request, export all exportable data in a structured, commonly used and machine-readable format (Article 30).

Its rules against unfair terms on data access between businesses cover contracts signed since 12 September 2025; from September 2027 they will extend to older contracts of indefinite duration or running beyond January 2034. A draft amendment published on 19 November 2025 could still change the regulation, so check the text in force when you sign.

One limit matters for a website: the regulation exempts services whose main features have mostly been custom-built for one client, and which are not offered from a catalogue, from several of these obligations, free switching among them. It also says nothing about your domain name, your content or the rights in your site. For a site or a tool built for you, your contract has to cover everything.

This is not only a legal question. In the UK, the Competition and Markets Authority found in 2025 that fewer than 1% of customers switch cloud provider each year, and that data egress fees are a key commercial barrier.

What should be in your name from the start

A clause matters less when most things already belong to you. This is what we commit to for our clients:

• Everything is in your name: domains, accounts and hosting are registered in your company name, never ours.
• Everything is handed over: code delivered, data exportable, documentation written.
• The technology is standard, and anyone can take over after us.

If your domain names are currently scattered across several accounts, or your site depends on a single supplier, start there, before even talking about a clause. The requirements document for a new project is the right place to demand these three points.