TL;DR:
- Ex-employees with live accounts are a major source of data breaches — disable access the moment someone leaves, not a week later.
- The biggest risks are shared passwords they know, email accounts left open, and access to cloud software like Xero, Slack, and Google Workspace.
- GDPR requires you to remove access to personal data immediately for departing employees; keeping accounts active is itself a compliance issue.
When a member of staff leaves — whether on good terms or not — your first security task is straightforward: remove their access to everything. In practice, most small businesses do this partially, slowly, or not at all. A survey by identity security firm Cerby found that 58% of employees still had active accounts at their previous employer 30 days after leaving. For small businesses without a dedicated IT person, that number is likely higher.
This isn’t a theoretical risk. The ICO’s breach database includes dozens of cases where ex-employees accessed customer data, deleted files, or forwarded emails to personal accounts after their employment ended. Some did so maliciously; many did so because the accounts were simply still there and old habits continued.
Here’s what needs to happen on the day someone leaves, and in the days immediately after.
On Their Last Day
1. Disable the primary email account immediately
Email is the master key to almost everything else. Most password resets, login confirmations, and business notifications go to email. Disabling it first limits the damage from anything else that gets missed.
Google Workspace: Admin console → Users → Suspend the user. Don’t delete immediately — you need to transfer emails and check for anything important first. Suspension stops access without deleting data.
Microsoft 365: Microsoft 365 admin centre → Users → Active users → Block sign-in. Again, don’t delete yet.
Set up an out-of-office message before suspending so external contacts know who to contact instead.
2. Change all shared passwords they knew
This is the most commonly neglected step. If your business uses any accounts shared among staff — the company Twitter/X login, a supplier portal, a shared email address, a broadband router admin panel — and the departing employee knew the password, change it now.
Write down every shared account you can think of and change them all before the end of the day. If you use a password manager (which you should), the shared vault makes this easier — but you still need to rotate the credentials, not just remove the person’s access to the vault entry.
3. Revoke active sessions on all devices
Simply suspending an email account doesn’t immediately disconnect active sessions on devices the employee is currently using. Most platforms let you force a sign-out from all active sessions.
Google Workspace: Go to the user’s profile → Security → Recent activity → Sign out all sessions.
Microsoft 365: Revoke sign-in sessions via the admin portal or with PowerShell: Revoke-MgUserSignInSession -UserId user@yourdomain.com
Any other platform: Look for a “sign out all devices” or “active sessions” option in account settings.
4. Retrieve company devices
If the employee has a company laptop, phone, or tablet, arrange to collect it on their last day or arrange immediate return. Do not leave company devices with ex-employees for “a few days” while they transfer personal files — this is a data risk and the arrangement rarely ends cleanly.
Before returning the device to use:
- Perform a factory reset / wipe
- If on Windows with BitLocker, ensure you have the recovery key before wiping
- On Mac with FileVault, revoke the user’s account via Apple Business Manager or MDM if used
5. Collect physical access items
Key fobs, access cards, parking passes, and any physical keys should be collected on the last day. If this isn’t possible (e.g., remote worker returning by post), deactivate the key fob immediately and don’t wait for its physical return.
In the 24-48 Hours After
6. Audit cloud software access
Go through every cloud tool your business uses and check for the ex-employee’s active account. Common ones small businesses forget:
- Accounting: Xero, QuickBooks, FreeAgent, Sage — these contain bank account details and financial data
- Communication: Slack, Teams, WhatsApp Business
- File storage: Google Drive, Dropbox, OneDrive — check for shared drives and folders they had access to
- Project management: Notion, Asana, Monday, Trello
- CRM: HubSpot, Salesforce, Zoho — contains customer contact data
- E-commerce platforms: Shopify, WooCommerce admin
- Social media: Any scheduled posts that could be published under your business name
- Hosting and domains: GoDaddy, Namecheap, your hosting control panel — especially dangerous if they were managing your website
- Postage and shipping accounts: Royal Mail Click & Drop, Parcelforce
- Marketing platforms: Mailchimp, Klaviyo, Campaign Monitor
- Payment processors: Stripe, PayPal, GoCardless
For each one: remove the account or change the email/password if it was shared.
7. Transfer email and check for forwards
Before deleting the email account, forward it to a manager for 30–60 days so business correspondence doesn’t disappear into the void.
Critically: check whether the departing employee set up an email forward to a personal address. This is a common way for leavers to retain access to business information. In Google Workspace: Admin console → Users → Click user → Email → Check for active forwarding rules. In Microsoft 365: Check mail flow rules and mailbox forwarding settings.
8. Review shared files and folders
Check Google Drive or SharePoint/OneDrive for files or folders owned by the departing employee that other staff need. Transfer ownership to someone else, or copy critical files to a shared team location.
If the employee owned any shared drives or team folders, these may become inaccessible or lose access for other staff after the account is removed. Audit before deleting the account.
9. Remove from any external shared accounts you may have missed
Bank accounts, Companies House filing access, supplier portals, and professional membership accounts often require separate off-boarding. If the employee had signatory authority or admin access on any of these, notify the relevant institutions and arrange for removal.
GDPR Considerations
Under UK GDPR, ex-employees have the right to request deletion of their personal data from your systems. Their email archives and personal files on company devices must be deleted within a reasonable timeframe after departure.
You’re permitted to retain some data for legitimate business purposes (payroll records, for example, must be kept for several years under HMRC requirements). But you shouldn’t retain more personal data than necessary, and you should not keep the email account active indefinitely “just in case” — that is not a GDPR-compliant retention policy.
Document your offboarding actions and the date access was removed. If you ever face an ICO investigation following a breach involving an ex-employee, this documentation demonstrates that your process was sound.
The Simple System That Makes This Manageable
The reason offboarding fails in small businesses is usually that there’s no offboarding checklist — it’s done from memory, and things get forgotten. Create a short checklist document (a Google Doc or shared note works fine) that covers every system your business uses, and update it whenever you add a new tool. When someone leaves, work through it systematically.
If you use a password manager with a shared team vault, offboarding becomes faster: remove the person’s vault access, then rotate every password in the vault. If you use single sign-on through Google Workspace or Microsoft 365, suspending the central account automatically removes access to many integrated tools — though not all, so the audit step remains essential.
The 30 minutes this process takes on someone’s last day is vastly less expensive than the ICO fine, customer notification, and reputational damage of a breach caused by an ex-employee’s active account.