How to Review Return or Destruction of Confidential Information on Exit

Faye is about to treat a five-day destroy-all plus an absolute officer certificate as boiler. Knowing how to review return or destruction of confidential information on exit is a 20-minute hunt: elect return or destroy on a dated window, demand a qualified written officer certificate, name backup, legal-hold, and residual exceptions, write the cloud lag in days, then elect, certify, or walk.

September 2026. English law; courts of England and Wales. Faye, Ops at a 16-person UK SaaS, is the receiving party on a mutual NDA — a non-disclosure agreement — from a US partner. The packet — the exact file set that will be signed — includes clause 8: “Recipient shall, within five (5) days of written request, destroy all Confidential Information and all copies, and an officer of Recipient shall certify that no copies remain.” A pricing workbook and a 40-row list sit in SharePoint. Partner Slack: “just certify, everyone does.” Signature is Friday. The rush is the problem.

“Deleted” on Friday is not gone. An officer who certifies “no copies remain” while vendor timers still run has signed a sentence the systems cannot support. AWS S3 Lifecycle (live 21 September 2026): deletion can take days or even weeks after a rule is satisfied. Common Paper Mutual NDA §6 already carves backup policies; retained copies stay bound. Faye’s clause 8 has a five-day clock, an absolute certificate, and none of those sentences. The hidden miss is a certificate that cannot be true on the day it is signed.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Why does how to review return or destruction of confidential information on exit start with the election, not the heading?

A return-or-destroy clause is an election plus a date, not a heading. Circle destroy-only within five days with no “or return.” Demand return or destroy, at a named party’s election, within thirty days. Log “5-day destroy-only — fail” if they will not move the clock.

Do: name who elects and write a calendar date. Don’t: treat “promptly” as a date. GOV.UK IPO NDA guidance sample one-way clause 6: on request, return all copies and retain none — no destroy option, no day-count, no certificate. Thirty days is Terms.Law market colour, not a statute. For example, Faye’s paper is destroy-only, five calendar days.

What written officer certificate replaces “we will use reasonable efforts”?

“Reasonable efforts” with no officer and no date is fog. An absolute “no copies remain” is a false-statement trap once backups exist. Demand a written, dated certificate signed by an officer that, to that person’s knowledge after reasonable inquiry, active copies have been returned or destroyed except the named retention list.

Do: qualify the cert after reasonable inquiry. Don’t: swear “no copies remain anywhere.” Terms.Law negotiation flags never certify “all copies have been destroyed.” Typical mistake: Legal says “just certify” while SharePoint still holds the workbook. ICO disposal guidance: a destruction certificate is evidence, not magic.

Which backup, legal-hold, and residual-memory exceptions must be named?

Complete destruction of every copy is not how SaaS systems work, and a legal hold beats destruction. Write four exceptions: automated backups deleted on ordinary rotation; one archival copy for disputes; copies required by law or a litigation hold — do not destroy those; residual knowledge in unaided memory. All retained confidential information stays bound.

Do: put the exceptions in the paper. Don’t: pretend silence is a carve-out. ICO right to erasure is colour, not Faye’s statute: live systems can go now; put backups “beyond use.” Residual memory here is unaided memory as a destruction exception, not a licence to use their 40-row list. Slack legal holds preserve messages and files regardless of retention.

Is this the NDA duration hunt or the survival-years hunt?

Stay on the exit mechanic: return versus destroy, the certificate, named exceptions, and the lag in days. Time with counsel — a qualified lawyer, not the chatbot — spent on 3-versus-5-year clocks, or on which MSA — master services agreement — headings survive, is the wrong hunt. Open clause 8.

If the fight is definition, duration, or residuals-as-hidden-restraint, that is a different hunt: NDA review checklist. If the fight is which headings survive and for how many years, that is a different hunt: survival list after expiry. Confidentiality years are a different clock from “give the files back on a date.” Do: one sentence to each neighbour. Don’t: clone a duration table here.

When does cloud deletion lag — and how do you write the days?

Hitting Delete on Friday does not empty the cloud. Write three clocks: active systems within the dated window; backup rotation with named days; vendor timers as colour. Microsoft 365 Recycle Bin spans 93 days across both stages.

Do: write the lag in days. Don’t: certify the cloud is clean on day five. Microsoft Learn: a 93-day Recycle Bin spans first- and second-stage bins. Google Vault: Gmail keeps ^deleted mail at least 30 more days. In practice, Faye’s IT already named 93 days, 30-day AWS snapshots, and Gmail +30. ICO storage limitation: the test is to put data beyond use. Slack exports are copies unless carved.

How do you elect, certify, or walk?

Elect only if the log shows election + date, a qualified officer certificate, named exceptions with retained copies bound, and the lag in days. Certify here means the paper is certifiable — not that Faye signs Friday’s absolute cert. Walk if five-day destroy-all plus “no copies remain” plus no exceptions remain as a package.

Success bar: a one-page checklist plus one Friday pause sentence. Workflow: return vs destroy election + date → officer certificate (qualified) → backup / legal-hold / residual exceptions → not duration / not survival years → write the cloud lag → elect / certify / walk. Optional: upload the same PDF to document analysis for a first-pass — first machine pass that extracts clauses before a human reads every page — and a human still opens clause 8. Verify every High flag — a severity-high finding a named human still opens. Never mark the file ready for signature on this hunt alone.