In line with the DPA (Section11.6):

On any termination of this Data Processing Agreement for any reason: a) the Processor shall as soon as reasonably practicable Return or Destroy (as directed in writing by the Controller) all Personal Data and all information and other materials provided to it by or on behalf of the Controller in connection with this Data Processing Agreement; b) if the Controller elects for Destruction rather than return of the materials under clause 11.6(a) the Processor shall as soon as reasonably practicable ensure that they are destroyed and that all Personal Data is deleted from the Software and Planday System. Notwithstanding the above, Destruction shall not take place until the Processor has informed the Controller of the contemplated method of Destruction and received the Controller’s confirmation that Destruction shall take place in accordance with such method. Should the Controller not find the contemplated method of Destruction sufficiently effective, the Controller will inform the Processor of what method is considered sufficiently effective.