Quick answer: When an employee leaves, a company should immediately revoke system access, reassign or transfer owned files and accounts, archive relevant communications for compliance, and securely wipe any company data from personal or returned devices. A documented offboarding checklist, led jointly by IT and HR, ensures nothing falls through the cracks and protects the organization from data breaches or compliance gaps.
Every employee departure—whether it’s a resignation, retirement, or termination—creates a moment of vulnerability for a company’s data. During the transition, sensitive files, client information, and internal communications can slip through the cracks if there isn’t a clear process in place. A departing employee might still have access to shared drives, customer databases, or company email long after their last day, and that access doesn’t close itself.
This is why a well-defined offboarding process matters as much as onboarding. Companies invest significant time welcoming new hires and setting them up for success, but many overlook the mirror image of that process: closing accounts, transferring ownership, and securing data when someone exits. Without a plan, businesses risk data leaks, compliance violations, and even sabotage from disgruntled former staff.
This post walks through what should happen to company data when an employee leaves, who should be responsible for each step, and how to build a repeatable offboarding checklist that protects your organization long after someone has moved on.
Why Data Offboarding Matters for Every Business
Data offboarding isn’t just an IT formality. It’s a risk management function that touches legal compliance, intellectual property protection, and day-to-day operational continuity.
When an employee leaves without a proper data offboarding process, a company faces several risks:
- Unauthorized access: Former employees retaining login credentials can access systems, client records, or financial data they shouldn’t.
- Data loss: Project files, client correspondence, or proprietary research stored only on an individual’s device or personal cloud account can disappear when that employee leaves.
- Compliance violations: Industries regulated by frameworks like HIPAA, GDPR, or SOC 2 require strict controls over who can access sensitive data. Failing to revoke access promptly can trigger audit findings or penalties.
- Insider threats: Disgruntled employees have been known to delete files, leak client lists to competitors, or sabotage systems before their access is cut off.
A thoughtful offboarding process closes these gaps and ensures that company knowledge stays with the company, not with the individual walking out the door.
Who Is Responsible for Data Offboarding?
Offboarding should never rest on one department alone. It works best as a coordinated effort between HR, IT, and the departing employee’s direct manager.
HR’s role typically includes notifying relevant teams of the departure date, confirming the employee’s final tasks, and coordinating the return of physical assets like laptops or badges.
IT’s role covers the technical side: revoking system access, transferring file ownership, and securing devices. IT teams should maintain a master list of every platform, tool, and system an employee has access to, so nothing gets missed.
The direct manager’s role is to flag any ongoing projects, client relationships, or institutional knowledge that needs to be documented or handed off before the employee’s last day.
When these three groups collaborate on a shared checklist, offboarding becomes a smooth, predictable process rather than a last-minute scramble.
What Should Happen to Company Data When an Employee Leaves?
Here’s a breakdown of the specific actions that should happen, organized by category.
How should account access be revoked when an employee leaves?
Access revocation should happen as close to the employee’s last day as possible—ideally, the moment they walk out for the final time or at the exact time their employment ends. Delayed revocation is one of the most common and preventable data security failures.
This includes:
- Disabling company email accounts (or forwarding them to a manager, per company policy)
- Revoking access to shared drives, cloud storage, and internal databases
- Removing the employee from Slack, Microsoft Teams, or other collaboration tools
- Disabling VPN and remote desktop access
- Deactivating accounts tied to third-party SaaS tools (CRM, project management software, design tools, etc.)
- Changing shared passwords the employee had access to
A single sign-on (SSO) system can simplify this step considerably, since deactivating one central account can cut off access to dozens of connected tools at once.
What happens to files and documents owned by a departing employee?
Before access is revoked, someone needs to identify what the employee owned or managed. This includes shared documents, client files, email threads, and any data stored in personal folders on company systems.
Best practice is to:
- Transfer ownership of shared files (such as Google Drive or SharePoint documents) to a manager or teammate.
- Export or archive the employee’s email account for future reference, especially if it contains client communications or project history.
- Review any local files stored on the employee’s device and move relevant ones to shared, team-accessible locations.
Skipping this step often means losing institutional knowledge. A departing project manager might be the only person who knows where a critical client contract lives, or why a decision was made months earlier. Capturing that information before they leave prevents costly gaps.
How should company devices and personal devices be handled?
If the employee used a company-issued laptop, phone, or tablet, that device should be returned and wiped according to company data retention policy before being reassigned or retired.
If the employee used personal devices for work under a Bring Your Own Device (BYOD) policy, the company should remove corporate data remotely, which is usually done through a mobile device management (MDM) platform. This typically allows IT to wipe company apps, email, and files from a personal phone or laptop without touching the employee’s personal data.
Companies without an MDM system in place should consider adopting one if they allow BYOD arrangements, since manually verifying that company data has been deleted from a personal device is difficult to enforce.
What should happen to data for compliance and legal purposes?
Depending on the industry, certain employee data and communications may need to be retained for a specific period, even after someone leaves. Choose a retention approach based on your industry’s regulatory requirements: healthcare organizations should retain records according to HIPAA guidelines, financial firms should follow SEC or FINRA retention schedules, and companies operating in the EU need to account for GDPR requirements around personal data.
A compliance-focused approach to offboarding includes:
- Archiving (not deleting) email accounts and relevant communications for the legally required retention period
- Documenting the offboarding date and actions taken, in case of future audits or legal disputes
- Consulting legal counsel on any non-compete, non-disclosure, or intellectual property agreements that may affect what the employee can or cannot do with knowledge gained during employment
What role does a knowledge transfer play in data offboarding?
Beyond the technical and legal aspects, offboarding should include a knowledge transfer process. This is where the departing employee documents ongoing projects, key contacts, passwords, and processes that only they fully understand.
A structured knowledge transfer might include:
- A written handover document outlining active projects and their status
- A walkthrough meeting with the employee’s replacement or manager
- Updated documentation in shared wikis or project management tools
Choose a formal knowledge transfer process if the employee held a specialized role, managed client relationships, or had deep institutional knowledge that isn’t documented elsewhere. For more junior or highly standardized roles, a brief handover document may be sufficient.
Building an Offboarding Checklist That Actually Works
The best way to ensure consistency is to create a standardized offboarding checklist that HR and IT follow every time an employee leaves, regardless of the circumstances. A strong checklist typically includes:
- Notify IT and HR of the departure date as soon as it’s known.
- Identify all systems, tools, and accounts the employee has access to.
- Schedule a knowledge transfer session with the employee’s manager or replacement.
- Transfer ownership of shared files and documents.
- Archive the employee’s email account according to retention policy.
- Revoke all system and account access on the employee’s last day.
- Collect and wipe company-issued devices.
- Remove company data from personal devices (if applicable).
- Document the offboarding process for compliance purposes.
- Conduct an exit interview to capture feedback and confirm understanding of any post-employment obligations (like non-disclosure agreements).
Having this checklist built into your HR software or project management tool ensures it gets followed every time, not just when someone remembers.
Protecting Your Company’s Data Starts With a Plan
Data doesn’t walk out the door on its own, but without a clear offboarding process, companies make it easy for sensitive information to leave along with a departing employee. A structured approach—one that combines prompt access revocation, careful file transfer, device management, and compliance-driven data retention—protects the business long after someone has said their goodbyes.
If your company doesn’t already have a documented offboarding checklist, now is the time to build one. Start by mapping out every system your employees touch, assign clear ownership between HR and IT, and make the process a standard part of every departure, not an afterthought reserved for high-risk exits.
Frequently Asked Questions
How quickly should a company revoke an employee’s system access after they leave?
Access should be revoked on the employee’s last working day, ideally at the exact time their employment officially ends. For high-risk terminations, some companies revoke access immediately upon notice of termination to prevent any potential data tampering.
What should happen to a departing employee’s email account?
Rather than deleting it immediately, most companies archive the email account for a retention period determined by company policy or industry regulation. This preserves client communications and project history while preventing the former employee from continuing to use the account.
Does a company need special software to manage data offboarding?
Not necessarily, but tools like single sign-on (SSO) platforms and mobile device management (MDM) systems make the process far more efficient, especially for companies with remote employees or BYOD policies. Smaller companies can manage offboarding manually with a detailed checklist, though this requires more diligence to execute consistently.
What happens if a company fails to properly offboard an employee’s data access?
Failing to revoke access promptly can lead to data breaches, compliance violations, and in some cases, sabotage from former employees who retain access to sensitive systems. It can also result in lost institutional knowledge if files and project information aren’t transferred before the employee’s departure.
Who should be involved in the data offboarding process?
Effective offboarding typically involves HR, IT, and the departing employee’s direct manager. HR manages the administrative and policy side, IT handles access revocation and device security, and the manager ensures ongoing projects and client relationships are properly handed off.