Module 2 · 2.3

English

Nederlands English Deutsch Français Español

Recognising and preventing lock-in

Module 2: What is a European cloud, really? · Reading time: 11 minutes

Learning objective: After this lesson, you can recognise the four types of lock-in in your current services, explain which switching rights the European Data Act gives you, and take measures with your new service so you can leave again later.

Key concepts: lock-in, technical lock-in, contractual lock-in, knowledge lock-in, integrations, proprietary format, exportable data, Data Act (Regulation (EU) 2023/2854), switching costs, notice period, transitional period, retrieval period

What is lock-in?

Lock-in (vendor dependency) means that leaving a provider is so difficult, expensive or risky that you stay, even if you actually want to go. This rarely happens all at once. It grows: a few more shared folders each year, an extra app that "just" logs in with your account, a form built into the platform.

Bakkerij De Korrel discovered this the first time it tried to leave. Moving mail turned out to be doable. But then the barriers appeared: documents that only existed as links, an order form on the website built into the old platform, a till system that worked with "sign in with Google", and a contract with eight months still to run.

There are four types of lock-in. Once you recognise them, you can tackle them.

1. Technical lock-in: proprietary formats and features

Your data is in a form that only works with this provider.

Google documents. A Google Docs, Sheets or Slides file isn't a file on a disk, but a document in Google's database. In Google Drive for desktop you see a shortcut (.gdoc, .gsheet, .gslides) of a few hundred bytes containing only a reference. Copy it to another service and you have nothing. You need to export them: Google then converts them to docx, xlsx and pptx (or odt, ods, odp). Lesson 6.1 shows how.
Chats and meetings. Chats in Teams or Slack, recordings and whiteboards usually can't be taken to another chat system. At most you can export them as an archive.
Built-in forms, automations and apps. Microsoft Forms, Power Automate, Google Apps Script, or a "flow" that does something with every email. You'll need to rebuild these elsewhere.
Features that don't fit a standard. Gmail labels (one email can have several labels, whereas an IMAP folder is only one location), categories and colours in Outlook, comments in a shared folder. Some of this carries over, some doesn't.

2. Integrations: what's attached to your account

Many apps sign in with your Google or Microsoft account (single sign-on, "sign in with Google"). If that account disappears, you can no longer sign in to those apps. Other integrations include:

your website, which sends mail via the old service;
the scanner or multifunction device that scans to the old mail or storage;
your bookkeeping software, which saves invoices in the old storage;
a newsletter service or webshop that relies on the old domain or old mail;
verification records of the old service in your DNS.

You'll find these in your account's security settings (at Google and Microsoft this is roughly called "apps with access to your account"), in your password manager, and by asking your colleagues. Lesson 3.1 turns this into a fixed step.

3. Contractual lock-in: term and conditions

An annual contract or multi-year discount with a penalty for early cancellation.
A long notice period.
Terms the provider may change unilaterally.
Data that is deleted immediately after the contract ends, with no time to retrieve it.

So first check with your current service when you can cancel. This also determines when your migration needs to be finished (lesson 3.3).

4. Knowledge lock-in: habits and skills

Colleagues know the buttons, shortcuts and tricks of the old system. The administrator knows the admin portal. This is the hardest lock-in to deal with, because it isn't written into any contract. You tackle it with time, explanation and training (lesson 9.1), and by choosing a new service that works with familiar formats.

What the Data Act regulates

The European Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. Chapter VI (Articles 23 to 31) covers switching between data processing services: cloud services such as storage, mail and online office software. The key points:

Article	What it regulates
23	Providers may not put up commercial, technical, contractual or organisational obstacles that hinder switching to another provider or to your own servers.
25	The contract must set out the switching rights in writing, including: a notice period for starting the switch of at most two months; followed by a transitional period of at most 30 days during which the service keeps working and the provider gives reasonable assistance (only if that is technically unfeasible: an alternative period of at most seven months, with an explanation within 14 working days); a complete description of all exportable data; a retrieval period of at least 30 days after the transitional period; and complete deletion of your data afterwards.
26	The provider must inform you about switching procedures, formats and known limitations.
28	The provider must state on its website which jurisdiction its infrastructure falls under and what measures it takes against access by foreign governments.
29	Switching costs: from 11 January 2024 to 12 January 2027, providers may only charge reduced switching costs (no more than their own costs). From 12 January 2027, they may not charge any switching costs at all, including costs for transferring out data (egress).
31	Exceptions, including for custom services built for a single customer and for trial versions.

What the Data Act doesn't do: it doesn't ban ordinary subscription fees or a penalty for cancelling a fixed-term contract early (these must be stated clearly in advance, Article 29(4)). Nor does it make your Teams chats work in a different chat program. It gives you the right to your data in a usable form, not to identical functionality elsewhere.

This is an explanation, not legal advice. For a large contract or a dispute with a provider, seek professional advice.

Preventing lock-in with your new service

The best time to prevent lock-in is before you start. Write down these agreements for yourself:

Your own domain name, under your own control. Your email address is info@example.com, not an address on the provider's domain. The domain name is registered to your organisation, and you know how to change the nameservers. Then you can always move your mail without your address changing.
Standard formats as your working format. Documents as docx or odt, calendar via CalDAV, contacts via CardDAV. No critical processes in a proprietary form- or automation platform without knowing how to get them out.
No single sign-on with your cloud provider for critical apps, or at least a list of which apps depend on it.
An annual exit test: retrieve a folder, a calendar and a mailbox, and put them in a different environment (lesson 8.2).
A contract you can actually read: notice period, what happens to your data after the end, and the switching rights under the Data Act.

In practice: what it looks like with a provider

In a WebOké Nextcloud, files are stored as ordinary files: a docx remains a docx, even if you edit it with Euro-Office in the browser. You export calendars and contacts as ICS and vCard, and with the desktop app a copy of your files sits on your own computer. Your email address stays on your own domain. With other European providers working to the same standards, this is comparable. Always check it yourself with a small export test before moving everything.

Summary

Lock-in grows slowly: proprietary formats, integrations, contracts and habits.
Google documents aren't files: a .gdoc is only a reference. Export them.
Integrations such as "sign in with Google", scanners and websites need to be mapped out in advance.
The Data Act gives switching rights: notice period of at most two months, transitional period of at most 30 days, at least 30 days to retrieve data, and no switching costs from 12 January 2027.
Prevent new lock-in with your own domain, standard formats, fewer integrations and an annual exit test.

Quiz

Exercise

Exercise E2.3: Lock-in scan of your current services. Go through your current services against the four types of lock-in. Note down at least one example from your own organisation for each type, what you're going to do about it, and look up the notice period in your current contract.

Exercise E2.3: Lock-in scan of your current services

Go through your current services using the four types of lock-in and look up the notice period in your contract. Put the cancellation date minus 30 days in your own calendar.

Technical lock-in: one example (for instance "200 Google Sheets") and your countermeasure.

Integrations: one example (for instance "till system with Google sign-in") and your countermeasure.

Contractual lock-in: end date or notice period of your current contract, and whether there's a penalty for ending early.

Knowledge lock-in: which skill or habit is hardest to change, and how will you tackle that?

Which of the five precautions (your own domain, standard formats, fewer integrations, exit test, readable contract) are you taking with your new service, and which not yet?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing