Employee Leaving? IT Offboarding Checklist for Small Businesses

Why IT offboarding matters for a small business

In a small team, one person often holds the keys to many things: the company Instagram, the domain registrar, the supplier portal and the bank token. If their access is not removed, a former employee (or anyone who later steals their password) can still read customer data or send email in your name.

There is also a data-loss risk in the other direction. Delete an account too fast and you can lose years of email and files that belong to the business. The goal is both: cut access fully, keep the data.

The day-of-exit IT offboarding checklist

Work through these steps in order on the person's last working day, ideally while they are handing over. Agree the timing with HR or the manager so access is cut when they finish, not days later.

1. 1

   Block sign-in and sign them out everywhere

   In Microsoft 365 or Google Workspace, reset the password, block sign-in and end all active sessions so phones and browsers that are already logged in stop working too.

2. 2

   Remove MFA methods and app passwords

   Delete their registered authenticator apps, phone numbers and any app passwords, so a saved second factor can't be reused if the account is ever re-enabled.

3. 3

   Keep their email

   Convert the mailbox to a shared mailbox (Microsoft 365) or transfer the mail to a colleague (Google). Set an auto-reply giving the new contact.

4. 4

   Transfer files and calendars

   Move OneDrive or Google Drive files they own to a manager. Hand over calendars, shared folders and any group or distribution list they own.

5. 5

   Change shared passwords

   Change every shared login they knew: bank, domain registrar, website admin, social media, supplier portals and Wi-Fi.

6. 6

   Remove them from other apps

   Accounting, CRM, booking, POS, payment dashboards, cloud storage, design tools and Corppass. Check who is admin on each.

7. 7

   Recover and wipe devices

   Collect company laptops and phones, remove company data from personal phones, and wipe or reassign the hardware.

8. 8

   Record what you did

   Note the date, who did each step and what data you kept. This is your evidence for PDPA and Cyber Essentials.

Offboarding a Microsoft 365 user

Microsoft's own guide to removing a former employee sets out the order: block sign-in, save the mailbox, wipe and block mobile devices, forward or convert the mailbox, give a colleague access to OneDrive, remove the licence, and only then delete the account.

• Shared mailbox instead of a paid licence. Microsoft lets you convert a user mailbox to a shared mailbox and remove the licence if the mailbox is under 50 GB. Don't delete the user account afterwards; the shared mailbox needs it as an anchor.
• The 30-day clock. When you remove a licence or delete the account, Microsoft says email, contacts and calendar are kept for 30 days and then deleted permanently. Move what you need before that.
• OneDrive. Give the manager access to the leaver's OneDrive before you delete the account, then copy anything important to a shared library.
• Legal holds. If there is a dispute or investigation, a hold needs Exchange Online Plan 2 or the archiving add-on on that mailbox. Ask before you delete anything.

Offboarding a Google Workspace user

Google's help page on deleting a user is clear: data that is not transferred is deleted, and a deleted user can only be restored within 20 days.

• Transfer before you delete. Any admin can migrate Gmail to another account or redirect incoming mail, and transfer Drive files the user owns. Files in shared drives already belong to the organisation and stay put.
• Calendars. Ask the leaver to transfer group calendars they own before they go. Google warns that secondary calendars are deleted with the owner.
• Archive instead of delete. Google's Archived User option keeps the account's data while blocking sign-in. Depending on your plan it needs an Archived User subscription, so check the cost in your Admin console first.
• Mail to the old address. You can add the old address as an alias on a colleague's account or a Google Group so customer emails keep arriving.

Shared passwords, apps and devices people forget

Email accounts are the easy part. Most leaks after someone leaves come from logins outside Microsoft or Google that were shared in a chat or spreadsheet.

A business password manager makes this much faster, because removing the person removes access to every shared vault at once. Our guide to choosing a password manager compares the options. If staff use personal phones for work email, our BYOD and device management guide explains how to remove only company data.

How long to keep a leaver's data under the PDPA

The PDPA's retention limitation obligation (section 25) says you should stop keeping personal data, or anonymise it, once it no longer serves the purpose it was collected for and you have no legal or business reason to keep it. The PDPC's guidelines on retention apply to employee data too.

In practice that means writing down a retention period, not keeping everything forever:

• Keep business email and files that are still needed for clients, contracts or accounting records.
• Delete personal items in the mailbox or drive once the handover is done.
• Set a review date for the shared mailbox or archived account (for example, 12 months) and delete it then if nobody needs it.
• HR, payroll and tax records follow their own legal retention periods; ask your accountant or HR adviser.

This is general information, not legal advice. Our PDPA checklist for small businesses covers the other obligations.

Do it yourself or get help?

For one leaver in a small team, the checklist above takes one to two hours if you have admin access and know which apps the person used. The hard part is usually the second list: knowing every place they had a login. Keep a simple access list per person from their first day, and offboarding becomes a matter of working down it.

If you would rather not rely on memory, our Access Review & Leaver Tool (from S$1,200) lists who has access to what across Microsoft 365 or Google and up to five other apps, and runs a one-click leaver checklist with an audit trail. Microsoft 365 / Google Security Lockdown (S$590) sets up MFA and admin roles properly, and a Password Manager Rollout (S$290) ends password sharing in chat for good.