---
title: "Time how long it takes to leave each · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/security-data-and-law/sub-processor-exit
id: TDD-19
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 954
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Time how long it takes to leave each sub-processor

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TDD-19
- Level: Recommended
- Chapter: [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)
- Rule: List every sub-processor with the personal data it holds and the export path for that data. Record the measured or estimated time to move to another provider, and mark each one that has no export path.
- Check: Every vendor in the invoices of the last 12 months appears in the report with data held, export path and time to leave. Each vendor without an export path has a finding with a severity.
- How: A buyer inherits every vendor contract. A vendor that holds customer data with no export is a lock-in the price should reflect. Start from the company's register in [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register.md) and compare it with the invoices and the outbound hosts in the code. A vendor in the invoices but not in the register is a finding. For each vendor, record the export format and who on the team has done an export. Note whether the contract requires deletion or return of the data at the end, as GDPR Article 28(3)(g) does. Deletion on exit follows [Confirm deletion when a vendor leaves](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
def exit_findings(vendors: list[dict], invoiced: set[str]) -> list[str]:
    registered = {vendor["name"] for vendor in vendors}
    findings = [f"{name}: invoiced but not in the vendor register" for name in invoiced - registered]
    findings += [f"{vendor['name']}: no export path" for vendor in vendors if not vendor.get("export_path")]
    return findings
```

### JavaScript example

```js
function exitFindings(vendors, invoiced) {
  const registered = new Set(vendors.map(vendor => vendor.name))
  return [
    ...[...invoiced].filter(name => !registered.has(name)).map(name => `${name}: invoiced but not in the vendor register`),
    ...vendors.filter(vendor => !vendor.exportPath).map(vendor => `${vendor.name}: no export path`),
  ]
}
```

## Sources

- [GDPR, Regulation (EU) 2016/679, Article 28](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- CMP-13 [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register.md) in Compliance and governance
- CMP-20 [Confirm deletion when a vendor leaves](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/security-data-and-law/sub-processor-exit">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [List every AI model the product depends on and its AI Act role](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review.md)
- [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)