1. The question about the future

By 2028, many organizations will want predictive models that answer their own questions: which customers may leave, which assets may fail, which changes tend to cause incidents. Those models depend on history: years of consistent, joined-up records about customers, orders, tickets, assets, changes and outcomes.

When AI and predictive models depend on your own history, will you have that history in a form you control, or will you be renting it back, one application screen at a time?

Much of that history now sits in SaaS applications and in cloud object storage that teams set up and then stopped thinking about. The data is the organization's property, yet in daily practice it is easy to treat it as something the application "has." The idea here is simple: you can usually ask for your data back, or set up a regular copy, and land it somewhere you control. A scheduled (for example nightly) export into your own landing zone is the starting point for the research and modelling the business will want later.

This piece is general information, not legal advice. Contract, privacy and records questions should go to your organization's counsel.

2. The signals today

Public buyers have long said "the data is ours"

Government cloud guidance has stated the ownership principle plainly for years. The Texas Department of Information Resources' Texas Cloud Services guide for state agencies and institutions of higher education (December 2014) says the agency "retains ownership of any user created/loaded data" on vendor infrastructure, and that agencies can request complete copies of that data whenever they choose.

Federal buying guidance has moved from ownership to exit planning. The U.S. General Services Administration's Cloud SIN ordering guidance (page last updated August 7, 2026) recommends that "a resilient acquisition includes a predefined 'exit plan' to mitigate concentration risk," that the exit plan help ensure "your data is returned in a non-proprietary format," and that buyers "require a 'Data Exit Price' or predefined extraction." It also notes that with subscriptions, "access terminates immediately upon the end of the billing term." Ownership and access are not the same thing.

Regulators are making switching and export a legal expectation

The European Union's Data Act (Regulation (EU) 2023/2854) "applies since 12 September 2025," according to the European Commission's Data Act explained page (last updated December 15, 2025). The Commission says providers of platform and software services must, at a minimum, "export data in a commonly used and machine-readable format," and that the Act "sets minimum requirements for the content of cloud contracts." From 11 January 2024 to 12 January 2027, providers may still charge for switching and data egress at cost; from 12 January 2027 the Act will "entirely remove switching charges, including charges for data egress."

A law-firm briefing on the switching chapter (Latham & Watkins, August 19, 2025) adds detail: SaaS is explicitly in scope; customers may start switching "on a maximum of two months' notice"; switching should be completed "within a maximum of 30 days from the end of the notice period," with extensions where it is technically unfeasible; and contracts must specify "all data and digital assets that can be ported." The regulation itself (Article 25 of Regulation (EU) 2023/2854) confirms both limits: a notice period of no more than two months, and a maximum transitional period of 30 calendar days after it, extendable to no more than seven months where the provider shows 30 days is technically unfeasible.

The Commission's Digital Omnibus proposal (November 19, 2025) would ease these rules for some older contracts with custom-made services and smaller providers, while keeping the phase-out of switching and egress charges. As of October 2026 it was still under negotiation, with the Council and European Parliament committees taking different views on those carve-outs. It is a proposal, not law.

For individuals, GDPR Article 20 gives a right to receive personal data "in a structured, commonly used and machine-readable format." The California Attorney General's CCPA page (updated August 28, 2026) describes a right to know what personal information a business collected, "up to twice a year, free of charge," and the Texas Attorney General's page on the Texas Data Privacy and Security Act ("effective July 1, 2024") lists the right "to obtain the personal data in a readable format." These are consumer rights, not business-to-business rights. But the business answering those requests has to find a person's data in every system that holds it, which is hard if your only view of SaaS data is each vendor's screens.

Egress fees and lock-in are on regulators' agenda

The UK Competition and Markets Authority's cloud services market investigation (summary of final decision, July 31, 2025) found that egress fees "reduce the ability and incentives for customers to switch or multi-cloud," that fewer than 1% of customers switch provider each year, and that these barriers "lock customers into their initial choice of provider." In its October 16, 2026 update, the CMA reports that the two largest cloud infrastructure providers have voluntarily changed their policies so that UK customers "can transfer data for free when switching cloud provider," with a longer switching window and lower multi-cloud transfer fees, while noting that "the uptake of these schemes has been limited so far." The CMA plans to review progress in spring 2027.

The direction is clear: moving data is becoming cheaper and more of a stated right, but rights only help if someone uses them.

The customer still owns protection and recovery

The shared-responsibility idea is easy to misread with SaaS. CISA's Cloud Security Technical Reference Architecture (co-authored with USDS and FedRAMP) notes that securing SaaS "relies heavily upon the service provider," but also that agencies "must work with their CSPs to determine responsibilities for data management and protection," and that "agencies should not assume that their data, applications, and infrastructure are automatically backed up." It also says agencies "should have policies for dealing with data when cloud services are terminated."

NIST's Cybersecurity Framework 2.0 (February 26, 2024) puts this into outcome language: ID.AM-07, "Inventories of data and corresponding metadata for designated data types are maintained"; PR.DS-11, "Backups of data are created, protected, maintained, and tested"; and GV.SC-10, which asks that supply chain risk plans include provisions for activities after a partnership or service agreement ends. NIST's updated ransomware profile, IR 8374r1 (June 2026), recommends that backups have "a copy stored offline or otherwise in a manner that prevents access" by attackers, and that relevant suppliers and other third parties be included in incident planning, response and recovery (GV.SC-08).

A governed copy is not a full backup strategy, but it often gives the first clear view of where SaaS data is and whether it can be restored or used elsewhere.

Open formats make "a copy you control" practical

The technical side has matured. Apache Parquet describes itself as "an open source, column-oriented data file format designed for efficient data storage and retrieval." Apache Iceberg calls itself "the open table format for analytic datasets," a "high-performance format for huge analytic tables" that several open-source query engines can work with at the same time, with full schema evolution and time travel that "enables reproducible queries that use exactly the same table snapshot." Delta Lake describes itself as "an open-source storage framework that enables building a format agnostic Lakehouse architecture."

Together these support the lakehouse pattern: files in open formats on low-cost cloud object storage, with table semantics (updates, history, schema changes) on top, readable by more than one engine. For SaaS data, that means a nightly export can land as plain files today and grow into governed, versioned tables later, without locking the copy into any one tool.

Many SaaS platforms offer bulk-export APIs, scheduled extracts, change feeds or "zero-copy" data sharing, and ELT pipelines (extract, load, then transform) move that data on a schedule. Capabilities, limits and fees vary by vendor and plan, so they belong on your contract checklist.

AI readiness starts with data you understand

NIST's AI Risk Management Framework asks organizations to document "data collection and selection (e.g., availability, representativeness, suitability)" (MAP 2.3) and to map risks "including the use of third-party data or software" (MAP 4.1), with GOVERN 6 covering "third-party software and data and other supply chain issues." DAMA International's DAMA-DMBOK, "the globally recognized framework for data management," frames the governance side. Before a model can be trusted, someone has to know where its data came from, how complete it is and who may use it.

Public-sector angle: records are records, wherever they sit

For Texas public entities, the ownership question has a records dimension too. The Texas State Library and Archives Commission's Local Schedule GR says retention periods "apply to records in any medium," and that electronic records "must remain available and accessible until the retention period" ends. A TSLAC blog post (September 7, 2021) on third-party systems cites Bulletin B's requirement to "maintain ownership and responsibility for electronic records regardless of where the record originates or resides," and recommends making sure the contract "leaves no doubt" the government owns its records and states "how the local government will be able to retrieve and to transfer its records." An earlier TSLAC post on cloud storage (November 2015) adds that records "need to be accessible not only to the government entity, but also to the public they serve."

The Office of the Attorney General's 2024 Public Information Act Handbook explains that public information includes information maintained by "a person or entity performing official business or a governmental function on behalf of a governmental body," and that "the mere fact that the governmental body does not possess the information" does not take it outside the Act. Data held in SaaS may still be subject to retention schedules and public information requests; pulling it out on demand is part of meeting both.

3. Plausible outcomes by 2028

These are scenarios to plan against, not predictions.

Scenario A: The governed copy

The organization keeps a scheduled, governed copy of its important SaaS data in open formats, in storage it controls. Each SaaS application has a known export method, frequency, owner and data classification, recorded alongside the application in the CMDB. Analysts have years of joined-up, documented history when the business asks a new question. Switching a SaaS vendor is a commercial decision, not a data rescue. Ransomware or a vendor outage is painful, but the organization still has its records.

Signals that tip toward A: contract language that names export format, frequency and fees; an owner for each data domain; regulators continuing to cut switching and egress charges; open table formats keep gaining support across engines.

Scenario B: Renting it back

Data stays inside each application. Analysis means hand-exported spreadsheets or each vendor's analytics add-on. History is lost at renewal or switching time because nobody requested it before the contract ended.

Signals that tip toward B: exports treated as a one-off migration task rather than a routine; no inventory of which SaaS holds which data; contracts silent on format and frequency; data teams stretched across too many tools to keep pipelines healthy.

Scenario C: The data swamp

The organization does copy its SaaS data, but without governance. Exports land in cloud object storage with unclear owners, mixed formats and no classification. Sensitive records sit in buckets with broad access. Nobody trusts the numbers enough to build on them, and the copy becomes a security and records liability instead of an asset.

Signals that tip toward C: pipelines built quickly for a single project; no retention rules for the copy; no data quality checks; storage access reviewed rarely or never.

Most organizations will land between these. The path from B to A runs through governance, not just more pipelines.

4. What to do now

A practical starting path

1. Map where your data lives. List each SaaS application and cloud storage location, what business data it holds, who owns it and how sensitive it is. Record it in the CMDB alongside the application and its business service.
2. Read your contracts. For each important application, look for clauses on data ownership, export rights, export format, frequency or rate limits, fees, data return and deletion at termination, and exit assistance. Note gaps; take questions to counsel.
3. Request or set up scheduled exports. Start with a nightly (or other regular) export of the most valuable data sets into a destination you control, using the vendor's bulk-export or API features, or an ELT pipeline.
4. Store in open formats. Land data as Parquet files, and organize it as Apache Iceberg or Delta Lake tables once the pattern is stable, so the copy is readable by more than one tool and changes over time are tracked.
5. Add governance. Apply classification, access controls, retention rules aligned with your records obligations, and lineage (which source, which export job, which date). Protect the copy the way you would protect the source system, including offline or immutable backup where appropriate.
6. Check data quality. Count rows against the source, check for missing fields, duplicated records and changing definitions.
7. Start with one question. Pick a single business question and a simple predictive model, such as which tickets are likely to breach their service level, or which customers are at risk of not renewing. Prove the path end to end before anything ambitious.
8. Fix it at purchase. Add data-related language to future SaaS purchases so the next contract is easier than the last.

A simple architecture, in words

SaaS applications (CRM, service management, finance, HR, security tools) feed a scheduled export or API extraction, typically nightly. Exports arrive in a landing zone on cloud object storage that your organization controls, written in an open file format such as Parquet. From there, data is loaded into a governed lakehouse or warehouse, organized as open tables, with classification, access control, retention and lineage applied. On top sit three uses: analytics and reporting; observability correlation, where business data (orders, customers, service levels) is joined with operational telemetry (events, incidents, changes) to see how IT behaviour affects business outcomes; and predictive models, trained on documented, quality-checked history.

For IT operations and data teams

• Treat each SaaS export as a monitored job: alert when it fails, runs late or returns far fewer rows than usual.
• Link data sets to CMDB records so incident, change and data teams share one picture of which system holds what.
• Pair business data with operational telemetry early. A model that predicts customer churn gets more useful when it can also see the incidents those customers experienced.

For the CIO and CFO

• Ask for a short register: top SaaS applications, data held, export method, contract position, and last successful export.
• Weigh the cost of a governed copy (storage, pipelines, people) against renewal leverage, resilience and analytics value.
• Fund one small, end-to-end use case before a broad data platform.

For public-sector buyers

• Check that each SaaS contract states ownership of records, how records are retrieved and transferred, what happens at contract end, and breach notification, in line with TSLAC guidance.
• Confirm that your retention schedule applies to records held in SaaS, and that the copy you keep follows the same schedule.
• Make sure you can answer Public Information Act requests for vendor-held data on time.
• Consider data exit pricing and non-proprietary return formats in solicitations, as federal guidance suggests.

Questions to ask every SaaS vendor about your data

1. Does the contract state that we own our data, including data generated by our use of the service?
2. What data can we export: all records, history, attachments, metadata and audit logs, or only some of it?
3. In what formats is export available, and are they open and machine-readable?
4. Can exports run on a schedule (for example nightly), and are there rate limits, volume caps or plan restrictions?
5. Are there fees for export, API use or data egress, now or at termination?
6. Is a change-data or incremental export available, so we do not have to copy everything every night?
7. How long after termination can we retrieve our data, and what exit assistance do you provide?
8. How and when is our data deleted after we leave, and will you certify it?
9. Who is responsible for backup and restore of our data, and how do we test a restore?
10. Will our data be used to train your models or features, and can we opt out?

Where this connects to the wider IT picture

Observability gets stronger when business data and operational telemetry sit side by side. The CMDB records which systems hold which data. Security operations depends on classification, tested backups and a recoverable copy in a ransomware event. And sourcing is where the leverage lives: the cleanest time to get export rights, formats, frequency, fees and exit assistance in writing is before you sign.

Drafted with AI assistance; sources checked and interpreted by King Tech.

Planning for this in your organization?

King Tech collaborates on custom solution architecture: we work alongside your team to design an approach that fits your systems, your constraints and your timeline. Contact King Tech to start the conversation.

Book a consultation Ask a question

Sources

All accessed October 18, 2026.

1. European Commission, "Data Act explained" (last updated December 15, 2025). https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained
2. Latham & Watkins, "EU Data Act: Significant New Switching Requirements Due to Take Effect for Data Processing Services" (August 19, 2025). https://www.lw.com/en/insights/eu-data-act-significant-new-switching-requirements-due-to-take-effect-for-data-processing-services
3. European Commission, Digital Omnibus proposal, COM(2025) 837 final (November 19, 2025). https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52025PC0837
4. EUR-Lex, Regulation (EU) 2023/2854 (Data Act) record (December 13, 2023). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R2854
5. GDPR Article 20, Right to data portability (gdpr-text.com). https://gdpr-text.com/en/read/article-20/
6. State of California, Department of Justice, "California Consumer Privacy Act (CCPA)" (updated August 28, 2026). https://oag.ca.gov/privacy/ccpa
7. Office of the Texas Attorney General, "Texas Data Privacy and Security Act" (effective July 1, 2024). https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
8. UK Competition and Markets Authority, "Cloud services market investigation: Summary of final decision" (July 31, 2025). https://assets.publishing.service.gov.uk/media/688b20e6ff8c05468cb7b120/summary_of_final_decision.pdf
9. UK Competition and Markets Authority, "Update on cloud actions, covering March to October 2026" (October 16, 2026). https://assets.publishing.service.gov.uk/media/6ad1cb60e5db84746b4796d1/Update_on_cloud_actions_-_covering_March_to_October_2026.pdf
10. U.S. General Services Administration, "Cloud SIN ordering guidance" (last updated August 7, 2026). https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/multiple-award-schedule-it/cloud-and-cloud-related-services/cloud-sin-ordering-guidance
11. Texas Department of Information Resources, "Texas Cloud Services: Guide for State Agencies and Institutions of Higher Education" (December 2014). https://dir.texas.gov/sites/default/files/Texas%20Cloud%20Services%20Guide.pdf
12. CISA, USDS and FedRAMP, "Cloud Security Technical Reference Architecture," Version 1.0 (August 2021), as quoted here; superseded by Version 2.0 (June 2022). https://www.cisa.gov/sites/default/files/2023-02/cisa_cloud_security_technical_reference_architecture_version_1_1.pdf
13. NIST, "The NIST Cybersecurity Framework (CSF) 2.0," CSWP 29 (February 26, 2024). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
14. NIST, "Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile," IR 8374r1 (June 2026). https://nvlpubs.nist.gov/nistpubs/ir/2026/NIST.IR.8374r1.pdf
15. NIST AI Resource Center, "AI RMF Core." https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
16. DAMA International, "DAMA Data Management Body of Knowledge (DAMA-DMBOK)." https://dama.org/learning-resources/dama-data-management-body-of-knowledge-dmbok/
17. Apache Parquet, "Overview." https://parquet.apache.org/docs/overview/
18. Apache Iceberg, project home page. https://iceberg.apache.org/
19. Delta Lake, project home page. https://delta.io/
20. Texas State Library and Archives Commission, "Local Schedule GR, Retention Schedule for Records Common to All Local Governments" (5th edition, effective April 17, 2016). https://www.tsl.texas.gov/slrm/localretention/schedule_gr
21. Texas State Library and Archives Commission, "Electronic Records, Third-Party Systems, and Contracts" (September 7, 2021). https://www.tsl.texas.gov/slrm/blog/2021/09/electronic-records-third-party-systems-and-contracts/
22. Texas State Library and Archives Commission, "Cloud Storage" (blog, November 2015 per URL). https://www.tsl.texas.gov/slrm/blog/2015/11/cloud-storage/
23. Office of the Texas Attorney General, "Public Information Act Handbook 2024." https://www.texasattorneygeneral.gov/sites/default/files/files/divisions/open-government/publicinfo_hb.pdf