EU law - Ignoring revocation of access rights after completing the task [closed]

Question

I would like to ask you very nicely for advice related to IT security and law. As a freelancer, if I provide a one-off service of programming to modify an information system, I will always ask the client to revoke my access rights upon completion to eliminate the risk in the event of a security breach of my systems.

Unfortunately, in practice, it often happens that clients do not cancel the accesses even after several of my urgings and thus I have active accesses long after the tasks are completed.

Therefore, I would like to ask whether, if due to my mistake or due to a security breach of my systems and e.g. a client's data is corrupted or even worse leaked, should I have any concerns or is it the client's responsibility that they did not cancel the accesses even after several calls? My preference would be to not have to deal with such things at all, but I don't know how to get the client to take a responsible approach and revoke my accesses after the task is completed, when at least basic security principles should be in their own interest.

...or am I requesting a revocation of access rights beyond the legal requirements, I don't have to request it and it is purely in the client's interest to do so?

Thanks a lot for each answer.

Answer 1

Did you do all that you could reasonably do?

If so, you cannot be found liable. However, that doesn’t prevent you from being sued and having to prove that you did all you could reasonably do. Of course, that’s why you carry professional indemnity insurance. Yo do, don’t you?

So, you should leave the account secure (strong password, TFA etc.), delete all references to those things at your end, and ask them to remove your access. And tell them what you’ve done.