Data Ownership Checklist

Quick answer: ownership is the easy clause and it is rarely the problem. What determines your position is access, portability, retention, and who else can reach the data. Establish all four in writing before signing, and test the portability claim with a real export.

The Contract Questions

Question	What a good answer looks like
Who owns the data you enter?	You do, stated plainly, including data derived from yours
Can you export it, and how completely?	Full export including history, relationships, and attachments, self-service
In what format?	An open, documented format you can import elsewhere
What happens at termination?	A stated retrieval window, a stated retention period, then deletion on request
Where is it stored?	Named jurisdictions, with notice before that changes
Who at the vendor can access it?	A defined support access model with logging
Can they use your data for other purposes?	No, or narrowly and with your consent, including for model training
What happens in a breach?	Notification to you within a stated period, with defined cooperation
Who owns custom work built for you?	You do, including the right to have a third party maintain it
Is there an API you can use directly?	Yes, documented, without per-call gatekeeping

The Tests That Beat the Clauses

Ask for a live sample export. Not a specification. An actual file from a working system, which you then try to import somewhere. This single test surfaces most portability problems, because exports routinely drop history, break relationships between records, or omit attachments.

Ask who has accessed your data. If the vendor cannot tell you, the access model is not logged.

Read the renewal clause before the feature list. Notice periods and renewal windows decide how much optionality you retain.

Ask about subprocessors. Your vendor’s vendors also hold your data, and the list should be available and subject to notice on change.

The BC Privacy Layer

Most British Columbia private-sector organisations fall under the province’s own Personal Information Protection Act, overseen by the Office of the Information and Privacy Commissioner for BC, in place of the federal regime. Public bodies fall under separate legislation.

That affects what you must be able to do, which in turn affects what your software must support: responding to an individual’s request for their own information, correcting it, and explaining how it is handled. A system you cannot query on a per-individual basis makes that harder than it needs to be.

Confirm which regime applies to you and what it requires with qualified counsel. This is general guidance and not legal advice.

Why This Is Worth Doing Before Signing

Every item here is negotiable before signature and almost none of it is negotiable afterward. The leverage exists exactly once.

See platform lock-in for why the cost of a wrong choice is set by how hard it is to reverse, and the Vancouver software planning guide for the other local questions worth settling early. POS systems and retail and hospitality technology cover the sector where these contracts bite most.