Marketing Agency Offboarding Checklist for Malta Businesses

Ending a marketing-agency relationship should not mean losing access to campaigns, data, creative files or the history behind important decisions. A controlled handover protects business continuity and gives the internal team or incoming provider enough information to take responsibility without rebuilding everything from scratch.

This marketing agency offboarding Malta checklist covers the practical work between giving notice and closing access. It complements DCP’s agency contract checklist and proposal-evaluation guide. Contract terms and legal obligations vary, so use qualified advice where needed.

Start with the contract and a named transition owner

Review the agreement before requesting files or removing access. Confirm notice periods, final deliverables, outstanding approvals, intellectual-property terms, data-processing responsibilities, confidentiality, platform ownership and any post-termination support.

Appoint one person in the business to coordinate the transition. That person should maintain the offboarding log, confirm what has been received and decide when access can safely be removed.

• Notice date and final service date
• Agency and client transition contacts
• Contractual deliverables and deadlines
• Outstanding invoices, credits and media commitments
• Accounts, data and assets to be transferred
• Access-removal sequence
• Incoming agency or internal owner
• Final acceptance and closure date

1. Build a complete account inventory

List every platform the agency has used or can access. Do not rely on the agency’s standard list because tools may have been added during the engagement.

• Google Ads, Microsoft Ads and other advertising platforms
• Meta, LinkedIn, TikTok and other social accounts
• Google Analytics, Tag Manager and Search Console
• Website CMS, hosting, domain and DNS
• CRM, email marketing and marketing-automation tools
• Call tracking, form tools and landing-page builders
• Dashboards, reporting connectors and data warehouses
• Design, video, stock-media and project-management tools
• Password managers, shared drives and communication channels

For each item, record the business owner, account ID, billing owner, current administrators, agency access method, recovery contact and whether the business can sign in independently.

2. Secure business-owned administrator access first

Do not remove the agency until the business has verified its own administrator access. Test login, multifactor authentication, recovery details and the ability to add or remove another user.

Google advises that an Ads account should retain at least one user with access before a manager account is unlinked. Campaign history remains with the individual Ads account after unlinking. Review Google’s official manager-account unlinking guidance before changing the relationship.

• Use named business email addresses rather than a former employee’s personal account
• Keep at least two appropriate internal administrators for critical platforms
• Move recovery email addresses and telephone numbers to the business
• Store backup codes securely
• Confirm billing profiles and payment methods
• Record account IDs and support references

If the agency created an account inside its own master structure, agree the transfer route before notice expires. A screenshot or report is not a substitute for control of the live account.

3. Transfer campaigns without deleting history

Preserve the existing campaign structure, settings, audiences, exclusions, conversion actions and change history. Avoid creating fresh advertising accounts solely to make the transition easier unless there is a documented business reason.

Paid search and display

• Active and paused campaigns, ad groups and assets
• Keywords, negatives, audiences and geographic settings
• Budgets, bid strategies and schedules
• Conversion actions, attribution settings and imported goals
• Merchant Center, product feeds and policy issues
• Scripts, automated rules and shared libraries
• Experiments, recommendations applied and known limitations

Google Ads provides separate controls for account users and manager relationships. Its official access-management guidance explains how administrators can review access levels and remove users. Document what will change before unlinking so tags, billing and connected products continue to work.

Paid social

• Business portfolio and advertising-account ownership
• Pages, profiles, pixels, datasets and catalogues
• Custom audiences and source-data responsibilities
• Campaign, ad-set and ad history
• Lead forms and lead-delivery routes
• Verified domains, apps and partner access
• Creative permissions and usage restrictions

Check each platform’s current administrator and partner-access settings directly. Do not share passwords as a shortcut where role-based access is available.

4. Export strategy, creative and working files

The handover should include editable source material and the context needed to use it, subject to the contract and licensing terms.

• Approved strategy, channel plans and campaign calendars
• Brand guidelines, messaging and audience definitions
• Editable design, video and copy files
• Image, font, music and stock-media licences
• Landing-page files and form configurations
• Content calendars and unpublished drafts
• Testing plans, results and learning logs
• Meeting notes, approval records and decision history

Ask the agency to identify anything that cannot be transferred, such as agency-owned templates, third-party licences or proprietary tools. Resolve these gaps before the final working day.

5. Preserve analytics and measurement continuity

Marketing can appear to fail after an agency change when the real problem is broken tracking. Capture the current measurement design before altering users, tags or integrations.

• Analytics account and property access
• Tag Manager containers and publishing permissions
• Conversion definitions and event names
• Consent settings and cookie categories
• Cross-domain and referral-exclusion configuration
• Dashboard calculations and data-source credentials
• CRM source fields, lifecycle stages and offline conversions
• Known tracking gaps, filters and historical changes

Google Analytics permissions can exist at account or property level. Google’s Analytics user-management guidance explains that access inherited at account level cannot simply be reduced at property level. Review both levels before removing agency users.

Use the digital marketing measurement-plan guide to document ownership, definitions and validation checks for the incoming team.

6. Request a final performance and learning report

A final report should do more than repeat the last monthly dashboard. It should help the next owner understand what was attempted, what changed and what still needs attention.

• Objectives, agreed KPIs and reporting period
• Results by channel and campaign
• Budget delivery and outstanding commitments
• Tests completed and conclusions
• Winning and unsuccessful messages or audiences
• Lead-quality observations and CRM feedback
• Technical, policy or tracking issues
• Open actions, deadlines and recommended next steps

Keep raw exports where useful, but require a plain-language explanation of definitions and limitations. The SEO reporting checklist and social reporting checklist provide channel-specific review points.

7. Handle personal data and confidential information

Confirm whether the agency acts as a data processor for leads, mailing lists, analytics exports or customer data. Follow the data-processing agreement and give written instructions on return, retention or deletion.

The European Data Protection Board explains that a processor contract should require the processor, at the controller’s choice, to delete or return personal data after the service ends. See its small-business controller and processor guidance. Retention may still be required by law or for legitimate records, so do not demand indiscriminate deletion without checking the applicable basis.

• List personal-data copies held by the agency and approved subprocessors
• Transfer required records through an appropriate secure method
• Confirm which data must be retained and why
• Obtain confirmation of deletion where the contract requires it
• Close shared folders, exports and temporary workspaces
• Record any unresolved privacy or security incident

8. Sequence access removal carefully

Access removal should be the final control step, not the first. Remove access too early and the agency cannot complete agreed work. Leave it indefinitely and former suppliers retain unnecessary privileges.

1. Verify business-owned administrators and recovery methods.
2. Receive and validate required files, exports and documentation.
3. Complete the final campaign and tracking review.
4. Transfer active responsibilities to the incoming owner.
5. Pause or replace agency-managed automations where needed.
6. Remove platform users, partner links, API tokens and shared credentials.
7. Rotate passwords only where shared credentials were unavoidable.
8. Review access logs and confirm closure in writing.

If an account supports role-based access, remove the agency role instead of changing a shared password. Also check service accounts, integrations, tokens and scheduled exports because they may continue to provide access after a visible user has been removed.

9. Plan the first weeks after transition

• Monitor campaign delivery, billing and disapprovals
• Validate forms, calls and conversion events
• Check scheduled reports and CRM synchronisation
• Review website, domain and landing-page availability
• Confirm new leads reach the correct people
• Track unresolved actions and supplier dependencies
• Keep the former agency contact route available for the agreed support period

Avoid making many strategic changes on the same day as the handover. Stabilise ownership and measurement first so any later performance change can be interpreted accurately.

Copyable marketing agency offboarding checklist

• Contract, notice period and final deliverables reviewed
• Internal transition owner appointed
• Complete platform and asset inventory created
• Business administrator access tested
• Billing, recovery and authentication details secured
• Campaign history and live settings preserved
• Creative source files and licences transferred
• Analytics, tags, events and dashboards documented
• Final performance and learning report accepted
• Personal-data return or deletion instructions completed
• Users, partners, tokens and shared access removed
• Post-transition monitoring and support period confirmed

Leave with continuity, not confusion

A professional offboarding process protects both parties. The outgoing agency can close its responsibilities clearly, while the business retains control of the accounts, information and evidence it paid to build.

If your Malta business needs a structured transition and a measurable plan for the next phase, explore DCP’s digital marketing services.

Featured image: Photo by Gabrielle Henderson on Unsplash.