Offboarding is the process that happens when an employee leaves: you close accounts, revoke permissions and ensure that company data stays with the company. If done carelessly, old accounts become open doors - one of the most common causes of data leaks are precisely accounts that were never closed when someone quit. A clear routine protects both you and your customers.

Why is offboarding so important for safety?

An account that remains active after a person quits is a risk. The person can still access email, files and systems – sometimes by mistake, sometimes on purpose. Even if you completely trust the terminater, a dormant account is a weak point that can be exploited by outsiders if the data is leaked. Closing accounts in a timely manner is one of the simplest and most effective security measures a business can take.

Checklist: what to do when someone quits?

Go through the points below as soon as you know a person is going to quit. Ideally, the most important steps should be completed on the day the employment ends:

  • Inventory all accounts and systemsthe person had access to – e-mail, cloud services, business systems, social media, external tools.
  • Close or deactivate the accountsinstead of deleting them right away, so you don't lose important information.
  • Restore or transfer ownershipof files, documents and email to a manager or successor.
  • Withdraw physical access– access card, keys, alarm codes.
  • Recover equipmentsuch as computer, telephone and any security keys.
  • Change shared passwordsknown to the person, for example to joint accounts.
  • Remove the person from distribution listsand authorization groups.

How do I manage the employee's email?

Do not delete the email account immediately. A common trick is to turn off the login but keep the mailbox for a period, and set up an auto-reply or forwarding to a colleague. That way you don't miss important customer communications. Once the transition period is over, you can archive or delete the account according to your thinning routine. Keep in mind that e-mail can contain personal data, so handling must comply with data protection regulations (GDPR).

What do the regulations say about data and GDPR?

When an employee leaves, personal data is often left behind - both about customers and about the employee himself. According to the data protection regulation (GDPR), you may only save personal data as long as you have a clear purpose. Have a thinning routine that says how long different types of data are saved and when they are deleted. The Swedish Privacy Agency (IMY) is the Swedish authority responsible for these issues and has guidance on its website.

How do I make offboarding a smooth routine?

The safest thing is to have a ready-made template that you follow every time, regardless of who quits. Then you won't forget any steps and the process will be the same every time. Many companies combine this with an access management system, where permissions can be pulled in one place instead of in ten different tools. If you have two-factor authentication and clear account management, both onboarding and offboarding will be much easier.

Do you want accounts, permissions and data security in order?Through the initiative Swedish Cybersecurity, ZORC helps companies build secure routines for access and offboarding - without hassle and in a language you understand. Get in touch and we'll go over how your company can better protect its data.