What Happens to Your Data When an Employee Leaves?

Offboarding Is an IT Risk Most Businesses Ignore

When an employee leaves your business, there is a lot to think about. Handovers, final payroll, returning equipment. But one of the most important — and most overlooked — questions is: what happens to your data when they walk out the door?

The answer, for most SMBs without a clear offboarding process, is uncomfortable. Former employees may still have access to company email, cloud files, or business systems days, weeks, or even months after leaving. In some cases, they take sensitive data with them — intentionally or not. In others, an old account becomes an easy entry point for a cyberattack.

Data offboarding is not just a security issue. It also has implications for compliance, customer trust, and business continuity. Here is what you need to know — and what to do about it.

The Risks of Poor IT Offboarding

Lingering Access to Business Systems

Every employee accumulates access over their time with your business. Email, cloud storage, CRM, accounting software, project management tools, internal dashboards. If their accounts are not deactivated promptly when they leave, that access remains live. A disgruntled former employee — or a hacker who compromises their old credentials — can use it to read, copy, or delete data long after the person has left.

This is one of the most common and preventable IT security risks for growing businesses. Yet many SMBs have no formal process for revoking access when someone leaves.

Data Walking Out the Door

Employees handle sensitive information every day: customer data, pricing, contracts, product roadmaps, financial records. Without controls in place, a departing employee can copy files to a personal drive, forward emails to a personal account, or download a CRM export on their last day — and there may be no record of it happening.

This is not always malicious. Sometimes people take documents they worked on because they consider them part of their professional portfolio, without realising they contain confidential business information. But whether intentional or not, the risk to your business is the same.

Compliance and GDPR Exposure

If your business operates in Europe or handles data from European customers, GDPR applies to how you manage employee data — including during offboarding. You have obligations around retaining, deleting, and securing personal data. Failing to properly offboard an employee’s accounts and data can create compliance exposure, particularly if a data breach later traces back to an unrevoked account.

Orphaned Accounts as Attack Vectors

Old accounts that no one monitors are attractive targets for attackers. Because the former employee is no longer logging in, unusual activity on the account may go unnoticed for a long time. This is one of the ways hackers target small businesses — finding a forgotten account, cracking or phishing the password, and using it as a foothold inside your systems.

Multi-factor authentication helps, but only if the account is still active. The only reliable solution is to deactivate accounts promptly and permanently.

What Good IT Offboarding Looks Like

A proper IT offboarding process does not need to be complicated. It needs to be consistent — applied every time, for every employee, regardless of the circumstances of their departure. Here is what it should cover:

Step 1: Trigger the Process on the Last Working Day

IT offboarding should be initiated on — or ideally before — the employee’s last working day. Do not wait until HR has finished all paperwork. Access revocation in particular should happen at a defined time, usually end of business on the final day or immediately upon departure in sensitive cases.

Step 2: Revoke Access to All Systems

Work through every system the employee had access to and deactivate or remove their account. This includes:

• Email and calendar (Microsoft 365 or Google Workspace)
• Cloud file storage (OneDrive, SharePoint, Google Drive)
• CRM and sales tools
• Accounting and finance software
• Project management and collaboration tools
• Any third-party SaaS applications linked to their work email
• VPN and remote access credentials
• Physical access codes or key fobs if relevant

If your business uses a centralised identity provider like Microsoft Entra ID (formerly Azure Active Directory), disabling the account there will cascade access removal across connected systems automatically — which is one of the strongest arguments for using single sign-on across your tool stack. This is the kind of structural decision that belongs in a well-thought-out IT roadmap.

Step 3: Preserve and Reassign Important Data

Before deactivating an account, make sure important business data is preserved and handed over. This includes:

• Emails and calendar history forwarded or accessible to a manager
• Files in personal cloud storage moved to a shared location
• Ownership of documents, tasks, and projects transferred to the appropriate colleagues

This step protects business continuity and ensures that the employee’s departure does not create gaps in institutional knowledge or active projects. It connects directly to how well your IT onboarding process is structured — businesses that onboard well tend to offboard well too, because roles and data ownership are clearly defined from day one.

Step 4: Retrieve Company Devices

Laptops, phones, tablets, and any other company-owned devices should be returned, wiped, and either redeployed or decommissioned. If a device cannot be physically returned — for example, a remote employee keeps it temporarily — it should be remotely wiped before any new use. Tools like Microsoft Intune or Apple Business Manager make remote device management and wiping straightforward.

If your business uses Windows Autopilot, recovering and re-provisioning a device after an employee departure is significantly simpler than managing it manually.

Step 5: Change Shared Passwords and Credentials

Many SMBs use shared accounts for certain tools — a shared social media login, a shared admin account, a shared email address. If the departing employee had access to any of these, the credentials should be changed immediately. This is also a good moment to audit whether shared accounts are necessary at all, or whether individual accounts with appropriate permissions would be more secure.

Step 6: Document What You Did

Keep a record of every action taken during offboarding: which accounts were deactivated, when, by whom, and what data was transferred or deleted. This documentation is valuable if a dispute arises later, and it may be required for compliance purposes under GDPR or other data protection frameworks.

Building Offboarding Into Your IT Policy

The businesses that handle employee departures smoothly are the ones that treat offboarding as a standard process rather than a reactive scramble. That means having a written IT offboarding checklist, assigning clear responsibility for each step, and integrating it with your HR process so that IT is notified of departures with enough lead time to act.

If you do not currently have this in place, it is worth building it alongside your broader IT policies. According to guidance from the UK National Cyber Security Centre, prompt account deactivation and device recovery are among the highest-impact actions a business can take to reduce insider risk — and they cost very little to implement correctly.

If you want help building an IT offboarding process that protects your business, or if you are not sure whether former employees still have access to your systems, get in touch with our team for a straightforward access audit.

Key Takeaways

• Failing to offboard employees from IT systems is one of the most common and preventable security risks for SMBs.
• Lingering accounts, uncontrolled data transfers, and orphaned credentials all create real exposure.
• A good IT offboarding process covers access revocation, data preservation, device recovery, and documentation.
• Centralised identity management (such as Microsoft Entra ID) makes access revocation faster and more reliable.
• Offboarding should be a standard, documented process — not something improvised each time someone leaves.

Veelgestelde vragen

When should you revoke an employee’s IT access when they leave?

Immediately — ideally at the end of the employee’s final working day, or sooner in sensitive cases. Every day an account remains active after someone has left is an unnecessary security risk.

Is employee offboarding a GDPR concern?

Yes. Under GDPR, you have obligations around how you manage, retain, and delete personal data — including data held in employee accounts. Failing to properly deactivate accounts and manage data after an employee leaves can create compliance exposure.

How do I make sure I do not lose important data when an employee leaves?

Before deactivating an account, forward or archive important emails, move files from personal storage to shared locations, and transfer ownership of documents and projects to relevant colleagues. Document every step for your records.

Can former employee accounts be used by hackers?

Yes. Old, unmonitored accounts are attractive targets for attackers because unusual activity may go undetected for a long time. Promptly deactivating accounts when employees leave is one of the most effective ways to reduce this risk.

What is the best tool for managing employee access offboarding?

Microsoft Entra ID (formerly Azure Active Directory) is the most effective solution for SMBs already on Microsoft 365. Disabling an account there automatically revokes access across all connected applications, making the process fast and reliable.