What's the protocol when a client stores data that violates their terms of service? Delete it immediately? Retain it until the client can retrieve a backup? Deny access until they sign a new contract?

I suspect that really depends on the content. What does Microsoft do when it's CSAM? They can't legally posses it but can't legally delete it because that would be destroying evidence. I'm sure there's a process.