A data export button is not the same as a usable exit plan. A business-critical software export drill proves that the right person can request the data, receive every archive, open the formats, find the records that matter, and preserve the result outside the original service. Run the drill while the account is healthy and there is time to resolve gaps.
Define the recovery question
Choose one practical scenario: the vendor is unavailable for a day, the subscription is ending, an administrator leaves, or the company must move a specific customer record into another system. List the minimum data needed to continue work, including attachments, comments, status history, relationships, users, and timestamps. Record the acceptable age of the export and how quickly the team must be able to retrieve it.
Use the provider's supported export path
Sign in with an authorized account and follow the provider's official export instructions. Record who can start the export, which products or workspaces are included, what formats are offered, where the download is delivered, and how long the link remains available. Google's Takeout guidance, for example, lets an account holder select products, delivery method, archive type, file type, and maximum archive size. Google also warns that changes made between the request and archive creation may not appear in the export. That is a useful reminder to record both request time and completion time.
Inspect the archive, not just the email
Download every part to an approved storage location. Confirm the expected number of archive files, extract them, and open representative records with ordinary tools. Check at least one old record, one recent record, an attachment, a deleted-or-closed status if the service exports it, and a relationship such as a customer linked to an order. Record missing fields, broken characters, unfamiliar identifiers, and formats that require special software. Never assume a successful download means the export is complete.
Test a limited recovery
Create a disposable workspace or local test folder and reconstruct one realistic case from the export without changing production. Time the exercise. Note any lookup table, schema documentation, encryption key, or vendor-specific tool required to make the files useful. CISA guidance on resilience emphasizes testing backups through restoration and comparing test results with recovery objectives; an export drill should use the same principle. The evidence is the recovered record, not merely the existence of an archive.
Close the gaps and retain evidence
Store the archive according to the business's retention and privacy rules. Save a short drill record with the account, scope, requester, timestamps, file hashes or sizes, test performed, result, gaps, and next review date. If the export excludes attachments, permissions, audit history, or recent changes, document a second capture method rather than claiming full portability.
Repeat after major configuration changes and before contract renewal or migration. A successful drill ends with a known owner, a readable archive, a demonstrated recovery, and a list of limitations the business can plan around.
Sources: Google Account data export guidance and CISA resilience guidance.
Sources
- How to download your Google data — Google
- Cybersecurity Capability Maturity Model Version 2.1 — Cybersecurity and Infrastructure Security Agency