Goal
When the system reaches end of life or the client changes supplier: return data in a usable format, hand over cleanly, delete personal data lawfully with evidence — and leave no orphaned servers.
Inputs → outputs
Inputs
- Contract: termination and data-return terms
- Inventory of assets, accounts, integrations
- Data retention policy and periods
Deliverables
- Decommissioning plan
- Returned data package + data dictionary + checksums
- Data deletion / destruction record
- List of retired resources (servers, accounts, keys, domains)
Teams & roles
- Project Management / Scrum Mastercoordinates the decommissioning plan
- Data & AIexports, verifies and deletes data
- DevOps / SREshuts down services, retires resources
- Legal & Financeretention duties, deletion record
- Application Security (AppSec)secure deletion, key revocation
- Support & Customer Successuser communication
- Client (Product Owner / sponsor)decides keep / delete, confirms receipt
RACI matrix
R — does the work · A — accountable, final sign-off (exactly one A per activity) · C — consulted before · I — informed after.
| Activity | Arch | PM | Dev | QA | Sec | Ops | Infra | Data | CS | Legal | Client |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Shutdown plan & user notice | · | A | · | · | · | · | · | · | R | · | C |
| Export & return data | · | · | · | R | · | · | · | A | · | · | C |
| Transition to a new supplier | R | A | R | · | · | · | · | · | · | · | C |
| Shut down & retire resources | · | · | · | · | C | A | R | · | · | · | · |
| Delete personal data & backups | · | · | · | · | R | · | · | R | · | A | C |
| Sign the exit record | · | R | · | · | · | · | · | · | · | · | A |
Arch = Solution Architecture; PM = Project Management / Scrum Master; Dev = Engineering (FE · BE · Mobile); QA = Quality Assurance (QA/QC); Sec = Application Security (AppSec); Ops = DevOps / SRE; Infra = Infrastructure & Network; Data = Data & AI; CS = Support & Customer Success; Legal = Legal & Finance; Client = Client (Product Owner / sponsor)
Quality gate
Client confirms receipt of all data; deletion record and retired-resource list signed.
Entry criteria
- Written decision to decommission or transfer
- Retention period agreed for each data category
Exit criteria
- Data returned with checksums; client confirms it is readable
- Personal data and backups deleted per plan, with a record
- No billable resources or live keys remain
- DNS and domains handled as agreed
- Exit record signed
Activities
- 1.Plan the shutdown: scope, timeline, user notice, dependencies (integrations, DNS, email)
- 2.Export and return data in open formats (CSV / JSON / SQL dump) with a data dictionary and checksums
- 3.Transition to a new supplier (if any): documents, source, handover sessions
- 4.Switch to read-only → shut down → redirect or release domains as agreed
- 5.Delete personal data and backups per the agreed retention; record the deletion
- 6.Cancel accounts, API keys, certificates, third-party licences; stop recurring billing
Checklist
Tick to self-review — 0/6. Ticks stay in this browser only and are not sent anywhere.
Document templates
Markdown (.md) files: open in any editor, or paste into Word / Google Docs. Each states its purpose, who fills it in and when.
Client involvement
- Decide which data must be kept (accounting, legal duties) and which is deleted
- Notify end users
- Confirm receipt of the data and sign the record
Tools
- pg_dump / CSV export
- sha256sum
- Cloudflare / nhà đăng ký tên miền
- Trình quản lý mật khẩu
Reference standards
- ISO/IEC/IEEE 12207:2017
- Disposal process: controlled end of a system
- Luật Bảo vệ dữ liệu cá nhân 2025 (91/2025/QH15)
- Law on Personal Data Protection No. 91/2025/QH15 — data subject’s right to deletion; delete when the purpose ends. Passed 26 Jun 2025, in force 1 Jan 2026 — confirm with counsel when applying
- Nghị định 356/2025/NĐ-CP
- Decree 356/2025/ND-CP detailing the PDP Law, in force 1 Jan 2026 (replaces Decree 13/2023) — valid deletion request: respond within 2 working days, complete deletion within 20 days
- ISO/IEC 27001:2022 — Annex A 8.10
- Information deletion when no longer required
- NIST SP 800-88
- Guidelines for media sanitization
Common pitfalls
- Shutting the server but forgetting backups stored elsewhere
- Deleting data the law requires you to keep (e.g. accounting records)
- DNS still pointing at a retired service → subdomain takeover
- Forgetting to cancel recurring billing
Real example
cuongthai.com: after the LLM gateway switch, the oldrb-*models stopped working — the repo notes say "wherever you seerb-, that path is dead", giving a list to hunt down and remove. The two old deploy workflows were not deleted but demoted to manual-only, with the reason written down. Retiring one operating path needs a record too, not only retiring a whole system.
Where to learn
Subjects and courses on cuongthai.com that teach this stage’s work.