Staff leaver checklist: lock down access when someone leaves (UK SME guide 2026)

Most leavers are not a threat. They have simply moved on. The risk is the access nobody remembered to remove. An unused account can be taken over months later, and nobody notices.

The NCSC advises organisations to have a "joiners, movers and leavers" process, so access is removed when it is no longer needed. See its 10 Steps guidance on identity and access management. This guide turns that into a checklist for owners with no IT team. It reduces risk. It cannot remove it.

Before the last day

Make a plan and pick a time

Agree when access will end. For most leavers, that is the end of their last working day. Put the time in the diary and decide who does each step.

Ask the leaver to hand over work in progress: client files, open jobs, and notes on anything only they know.

List every account and device

This is the step most firms skip. Write a simple list covering:

• Work email and files: Microsoft 365 or Google Workspace.
• Shared logins: any account the team shares, such as a supplier portal, social media, or the office Wi-Fi.
• Money: online banking, payment apps, card readers, the accounts software, and company cards.
• Your website: the domain registrar (where you bought the web address), web hosting, and the site's admin login.
• Other apps: CRM, booking systems, project tools, AI tools, and anything they signed up to with a work email.
• Devices and kit: laptop, phone, tablet, USB drives, keys, door fobs, and alarm codes.

Ask the leaver too. They often remember accounts you have never heard of.

Check who has admin rights

An admin account can add users, reset passwords, and change settings. If the leaver is an admin anywhere, make sure someone else is an admin too before you remove them. Otherwise you can lock yourself out.

Check Microsoft 365 or Google Workspace, your website, your bank, and your social media pages.

On the last day

Work through these in order, as soon as access should end.

1. Lock the work account

Microsoft 365: in the admin centre, go to Users, then Active users, and select the person. Reset their password, then choose Sign out of all sessions. Then choose Block sign-in. Microsoft says blocking can take up to 24 hours to work, and that resetting the password is the quick way to stop sign-in. See Microsoft's guide to blocking a former employee.

Google Workspace: in the Admin console, reset the password, reset their sign-in cookies, and remove their recovery email and phone number. Google's leaver checklist also covers app passwords and connected apps. You can suspend the user to stop sign-in while you sort out their data.

2. Reset MFA

MFA (multi-factor authentication) is the second check at sign-in, such as a code from a phone app. Remove the leaver's registered methods, such as their authenticator app and phone number. That stops an old phone being used as a way back in. Our guide to MFA for Microsoft 365 explains the basics.

3. Keep their email working for clients

Clients will keep emailing the old address, so do not just delete the account. In Microsoft 365, you can convert the mailbox to a shared mailbox that a colleague can open. Microsoft says a shared mailbox under 50 GB needs no licence. Reset the password first. Microsoft warns that otherwise the old username and password still work on the shared mailbox. See converting a mailbox to shared.

The other option is to forward new email to a colleague. In Google Workspace, move the email you need to a colleague's account before you delete the user. Either way, add an auto-reply that says who to contact instead.

4. Hand over their files

Files in their OneDrive belong to the firm, but only they can easily see them. Give their manager access before you delete anything. Microsoft says that once you delete an account, its OneDrive and mailbox content is kept for 30 days. After that, it can be gone. In Google Workspace, transfer their Drive files to a new owner first. And remember, OneDrive is not a backup.

5. Change shared passwords

Any password the leaver knew should now change. That includes shared logins, the Wi-Fi password, alarm codes, and any account where several people use one login. Start with anything that touches money or client data.

A password manager makes this much easier. You can see which shared items the leaver could open, remove their access, and update each password in one place. Read why shared logins are a liability and how to stop staff reusing passwords, or compare options in our password manager guide.

6. Remove them from banking and payments

Log in to your online banking, or call the bank, and remove them as a user. Cancel any company cards in their name. Remove them from payment apps, card readers, PayPal, and the accounts software. Check who can approve payments now.

7. Social media, domain, and hosting

Remove them as an admin on the firm's social media pages. Check the domain registrar and web hosting accounts. If any were set up in their name or with their personal email, move them to a company email address now. If you lose control of the domain, you can lose your website and email with it.

8. Collect devices and keys

Collect the laptop, phone, tablet, chargers, USB drives, keys, and door fobs. Tick each one off your list.

If a firm-owned device is not returned, use remote wipe. This works if the device was set up under Microsoft 365 or Google Workspace device management. For a personal phone, remove only the work data. Our lost or stolen laptop checklist covers what to do when a device goes missing.

In the week after

• Forwarding rules: check the old mailbox for rules that send email elsewhere, such as to a personal address. Delete any you find. Microsoft says inbox rules carry over when you convert a mailbox to shared.
• Admin roles: list every admin in Microsoft 365, Google Workspace, your website, and your bank. Remove anyone who no longer needs it.
• Suppliers and clients: tell key suppliers, your bank, and your accountant who the new contact is. This also helps against fake change of bank details emails.
• Licences: cancel or reassign paid seats and subscriptions in their name.
• Delete when ready: once you have kept what you need, delete the account and note the date on your list.

When someone leaves on bad terms

Most steps are the same. The timing changes.

• Remove access before you tell them, or during the meeting. Not afterwards. Have the steps ready to go.
• Do the high-risk accounts first: email, banking, the domain, and anything with admin rights.
• Change shared passwords the same day, not next week.
• Keep a simple log of what you did and when. It helps if there is a dispute later.
• If you think they took data or changed things, get help from an IT professional. If personal data may be affected, decide whether it is a breach. Some breaches must be reported to the ICO within 72 hours of you becoming aware.
• Take HR advice on the employment side. This guide only covers access.

UK GDPR: what you can and cannot do

The leaver's work email and files are business records. They often hold client personal data. Your firm is still responsible for that data after they go.

• Keep what the business needs. Client files, contracts, and work email may need to be kept for legal or business reasons. Move them to a colleague or a shared space.
• Do not keep it forever. UK GDPR says you should not keep personal data for longer than you need it. Set a review date for the old mailbox. See the ICO on storage limitation.
• Do not snoop. A work mailbox can still hold personal messages. Look for what the business needs, not for gossip. Only the people taking over the work should have access.
• Be open about it. Say in your staff policies that work accounts are kept and checked when someone leaves. The ICO's guidance on monitoring workers explains what it expects.

The ICO has a hub for small organisations. This guide is general information, not legal advice.

Copyable leaver checklist

Print this checklist (one page, no affiliate links).

FAQ

What should be on a staff leaver IT checklist?

List every account and device before the last day. On the day, lock the work account, reset MFA, keep email and files, change shared passwords, and remove banking, social media, domain and hosting access. In the week after, check forwarding rules and admin roles.

How quickly should I remove a leaver's access?

On their last day, at the time you agreed in advance. If they are leaving on bad terms, remove access before or during the conversation where you tell them, not afterwards.

Can I read a former employee's work email?

You can access it for business reasons, such as client work and handover. Limit who has access, avoid personal messages, and tell staff in your policies that this can happen.

Do I need to change shared passwords if the leaver was trusted?

Yes. It is not about trust. A password they knew could be saved on a personal device, written down, or leaked later. Changing shared passwords is routine, not an accusation.

Sources we checked

• NCSC: 10 Steps to Cyber Security: identity and access management
• NCSC: Small Business Guide
• Microsoft: Remove a former employee from Microsoft 365
• Google: Maintain data security after an employee leaves
• ICO: Employment practices and data protection: monitoring workers

Bottom line

Plan the exit and list every account before the last day. On the day, lock the account, keep the email and files, change shared passwords, and collect the kit. Check forwarding rules and admin roles the week after. Keep only what the business needs.