What you do with an employee’s data after they leave

Echipa HR 365 · reviewed 2026-09-05 · 5 min read

Somebody leaving has two parts that get permanently confused: closing their access to company data, which happens on day one, and the fate of the data about them, which follows rules and retention periods. The first is urgent, the second is important, and usually somebody deals with only one.

The day they leave: what gets closed

The last row is systematically forgotten. External platforms — benefits, training, recruitment tools — have their own user lists, which synchronise with nothing. People who left stay there for years, with working access.

The equipment and what is on it

Handing over a laptop is not complete when the handover form is signed. On it, almost certainly, are locally downloaded files — exports, tables, working documents. The practical rule: the laptop does not go to somebody else before being fully cleaned, and what was on it moves to its official home rather than being deleted unchecked.

The second case is more delicate: personal devices on which the person had access to work data. Here you can clean nothing; you can only withdraw system access and ask for confirmation that local files were deleted. Which is why how much work was done with downloaded files matters — the more there was, the less control you have at departure.

What stays about them

• The personnel file: kept for the applicable period, in its official home, with restricted access.
• Leave, timesheet and payroll records: kept as history; not deleted, but out of current reports.
• Reviews and conversation notes: kept as long as they are relevant; a manager’s informal notes are not company documents and can be closed.
• Personal contact details: narrowed to what is needed for remaining obligations.
• Accounts on training and benefits platforms: deactivated, not left active “in case they come back”.

Archiving, not deleting from the records

The distinction that simplifies everything: somebody who has left is not deleted from the system, they are marked as having left. Deletion breaks the history — their timesheets, leave, reviews — and ruins every report covering periods when they worked there. Marking removes them from current lists and keeps the past intact.

The practical consequence: reports have to know the difference. A headcount report as of today does not count them; one about last quarter does. If your system does not make the distinction, you will make it by hand, every time.

Where to start

Take the list of people who left in the last year and check, for three of them, whether they still have active accounts anywhere. Include the external platforms — that is most likely where you will find what you are looking for.

Then write the closing checklist across those six rows, with the names of the owners at your place. Without names, it gets executed partially at every departure, and always the same row gets skipped.

Who takes over what is left

A leaver’s working files are usually in three places: in the company systems, in their personal folder in the shared space, and locally on their equipment. The first two are transferred; the third is saved before cleaning or lost.

The order of transfer

1. The person leaving — moves what is worth keeping into the shared space, in the last week — not on the last day
2. The manager — checks what was moved and names who becomes the owner
3. IT — transfers ownership of personal folders to the manager, before deactivating the account
4. IT — saves the local content from the equipment before cleaning it

Email: how long and how

Redirecting to a colleague is practical and delicate: personal messages also arrive at a work address. The version that works is an auto-reply naming who takes over, for a declared period — usually a month — without forwarding the content.

If redirection is nevertheless needed for continuity, the person has to know. It is an important difference: not between legal and illegal, but between an announced operational measure and one discovered afterwards.

How long do I keep the redirected email?

A month is enough in most cases and is a period you can announce. Beyond that, it becomes a mailbox nobody checks any more, containing personal correspondence.

What if the person asks for their personal files from the laptop?

You hand them over, if they are clearly personal and if checking does not require reading anything else. Ideally the situation never arises: at handover, the person takes what is theirs, with somebody from IT present.