Employee Offboarding Checklist: Remove Access Before It Becomes a Risk

When someone leaves, their access usually stays: the website admin login, the Instagram password, the Google Business Profile, the shared Gmail. Most of the time nothing happens, but when it does, it's serious. A simple employee offboarding checklist prevents it. The same checklist applies when you change agencies or freelancers.

Before the last day

• List every system the person used (ask them, too)
• Arrange handover of files, client contacts, ongoing work and passwords via the password manager
• Transfer ownership of documents in Google Drive/OneDrive to a business account

On the last day: accounts

1. Business email: disable sign-in or reset password; set auto-reply/forwarding to a manager
2. Google Workspace / Microsoft 365: transfer data, remove licence later. See Microsoft 365 vs Google Workspace
3. Password manager: remove from shared vaults
4. Shared passwords they knew: change them (Wi-Fi, social media, Tally, bank netbanking user IDs)
5. Website / CMS admin: remove their user; check for new admin users they may have created
6. Hosting, domain and DNS panels. See who should own domain and hosting
7. Google Business Profile: remove from People and access. See Google Business Profile hijacked
8. Meta Business Suite, Google Ads, Analytics, Search Console
9. WhatsApp Business: log out linked devices; if they had the business phone, recover it
10. CRM, billing and accounting software
11. Payment gateway and bank user access
12. Cloud storage and file sharing links. See secure file sharing

Devices

• Collect laptops, phones, SIMs, access cards, keys, USB drives
• Wipe and reset company devices before reuse
• Remove company email/apps from personal phones (mobile device management helps)

After

• Review logs for unusual downloads or logins in the final weeks
• Update your access register
• Confirm the person's personal data you hold is handled as per policy. See DPDP Act compliance

Keep an access register

A simple sheet: person, system, access level, date given, date removed. It makes offboarding a ten-minute job.

FAQs

Should we remove access before telling them?

For sensitive roles or difficult exits, remove access at the same time as the conversation.

What about agencies?

Give agencies their own logins or partner access, never your owner account, so removal is easy.