Can I get my data out when leaving a security vendor?
You should be able to, but check before you buy, because the contract decides how easy it is. Ask which data you can export (alerts, device lists, reports, configuration), in which format, whether export costs extra, how long you keep access after notice, and when the vendor deletes the data and confirms it. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., a processor must return or delete personal data at the end of the service, as the data processing agreement sets out, and you choose which. Plan the exit at the start: keep your own archive of anything you may need later, such as evidence for an audit or an insurance claim, rather than relying on the vendor’s retention. With NetSenX, alerts can be exported through the API from the Pro plan and sent to a SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. from the Business plan, PDF compliance reports are available from the Starter plan, and the data processing agreement is published on the website.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What is the difference between data residency and data sovereignty?
- After the Schrems II ruling, can we still use security tools from US companies?
- Do a vendor’s data residency promises also cover logs, backups and support data?
- Which questions should we ask a security vendor about its sub-processors?
- Does a network monitoring service need a data processing agreement?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
- SIEM (security information and event management)
- A system that collects logs from many systems and looks for patterns across them.