Departing Employee Data Protection Playbook

The weeks between a resignation and the last day are when an employee is most likely to take customer lists, source code or pricing files, and when most organisations are watching least. Standard offboarding removes access on the final day; by then the copying, if it happened, is done. This playbook covers the departure window itself: the signals that raise risk, the triage questions HR, legal and security should answer together, when to remove access early, how to run a lawful look-back review, device return and exit interviews, the evidence to keep and when a finding becomes a notifiable breach. It is written for security, HR and legal teams and for the managers who receive resignations. Once theft is confirmed, switch to the Insider Data Theft Response Playbook; the routine access revocation sequence is in the Employee Offboarding Security Guide.

Key takeaways

Start at notice, not at exit. The departure window opens when the organisation learns someone is leaving, and a risk rating should be set within one working day.
Look back as well as forward. Copying often happens before resignation is announced, so review a defined period of prior activity, not just the notice period.
Monitoring must be lawful first. Under UK GDPR, workers must be told about monitoring in advance, a documented lawful basis is required, and covert monitoring is reserved for very exceptional cases.
Accounts are not the whole estate. Signing keys, API tokens, shared passwords and personal devices with synced data survive account disablement; the Coupang case shows the cost.
Reminders protect trade secret status. UK law protects information as a trade secret only where reasonable steps were taken to keep it secret, and documented exit reminders are part of that record.

How the incident shows up

A departure becomes a security event in two ways: a risk trigger tells you to watch more closely, or activity already observed points to data leaving. The patterns map to ATT&CK Exfiltration to Cloud Storage (T1567.002), Exfiltration over USB (T1052.001), Email Forwarding Rule (T1114.003) and Data from Information Repositories (T1213).

Trigger or signal	Source	Starting risk
Resignation to join a competitor, or refusal to say where they are going	HR, line manager	High
Dismissal, redundancy or a performance process ending badly	HR	High
Role with access to customer lists, source code, pricing, M&A or signing keys	Access records, data owners	High, whatever the reason for leaving
Bulk downloads from SharePoint, file shares or CRM exports above the person's baseline	DLP, cloud app logs, CRM audit	Escalate to triage
Files sent to personal email, or new forwarding rules to external addresses	Mail flow and audit logs	Escalate to triage
Uploads to personal cloud storage, USB copies or printing spikes	Endpoint DLP, proxy, print logs	Escalate to triage
Cloning repositories the person does not normally work on	Code platform audit and git events	Escalate to triage
Access requests to new systems after notice is given	IAM request history	Escalate to triage

Insider risk tooling can automate the trigger. For example, Microsoft Purview's "Data theft by departing users" policy template starts scoring when an HR connector supplies a resignation or termination date, or when the Entra account is deleted, and looks at downloads, printing and copying to personal cloud services near those dates. The Top 10 Insider Threat Indicators page covers the wider set of signals.

Triage questions

A small departure panel (HR, legal, security, the line manager and the data owner) answers these within one working day of notice. CISA frames insider threat management as detect and identify, assess, then manage; this is the assess step.

What can this person reach? List crown-jewel data, privileged roles, keys, tokens and shared credentials in their scope, including non-human identities they created or own.
Where are they going? A competitor, a customer or their own start-up changes the risk and the legal options.
What do their contracts say? Confidentiality, intellectual property assignment, garden leave and restrictive covenants determine what legal can do later.
What monitoring are we already allowed to do? Check the privacy notice and acceptable use policy. Under UK GDPR you must tell workers about monitoring before it begins; new or more intrusive monitoring may need a DPIA first.
What does the look-back show? Review prior activity against their baseline (see below) before deciding on early removal.
Do they hold company devices or company data on personal devices? This decides the device return and remote wipe plan.
Is a client relationship at stake? Departing salespeople and account managers are the classic customer list risk.

Containment priorities

Containment in a departure is mostly about timing. Match the action to the risk rating.

Risk rating	Access timing	Monitoring	Other actions
Low	Remove at end of last working day	Normal, already notified controls	Standard exit reminder and device return
Medium	Remove crown-jewel access at notice; keep role-essential access	Look-back review; heightened DLP alerting within existing notice	Data owner sign-off on handover; block personal cloud uploads
High	Garden leave or immediate removal at notice, if the contract allows	Look-back review; preserve logs immediately	Collect devices at the meeting; legal reminder letter
Evidence of copying	Remove immediately	Preserve everything; consider legal hold	Hand over to the insider data theft playbook

Coordinate the moment. For high-risk leavers, remove access during the meeting where notice is accepted or garden leave starts, not after it. Disable the identity provider account, revoke sessions and refresh tokens, and block mail forwarding.
Remove the access outside single sign-on. Local accounts in SaaS tools, code platforms, cloud consoles, VPN certificates and shared vault entries. The Employee Offboarding Security Checklist sets the order and timings.
Rotate what they knew. Shared passwords, break-glass credentials, API keys and signing keys they could read. Disabling the person does not disable a key; see the NHI Offboarding and Decommissioning Guide.
Restrict exfiltration routes for the notice period: block USB mass storage and personal cloud uploads for the user, and route attempts to alerts. See the Endpoint DLP Guide.
Reassign ownership of mailboxes, files, service accounts and automation so business processes do not break when the account goes.

Eradication

In a departure, eradication means removing company data from places it should not be and closing the access paths that remain.

Look-back review: examine a defined window of activity before notice (many teams use 30 to 90 days, set by policy and log retention) for downloads, exports, forwarding, cloud uploads, USB writes, printing and repository clones. Compare with the person's own baseline and peers in the same role. Record the window and the reason in the case file.
Personal devices: where mobile device management or app protection policy is in place, run a selective wipe of corporate data. Do not wipe a personal device fully unless the policy the person signed allows it.
Synced and shared copies: remove sharing links the person created to external addresses, and transfer or delete files in their personal storage area within the company tenant.
Return or deletion confirmation: if copying is found, legal can ask the person to return or delete specific material and confirm in writing, often through a solicitor's letter. Take legal advice before contacting a former employee about suspected copying.
Close dormant paths: check for personal access tokens, OAuth grants and SSH keys still tied to the person's identity in code and SaaS platforms.

Recovery

Complete the handover with the data owner: accounts, automations and client relationships reassigned, and any business process that depended on the leaver tested.
Run the exit interview with a security segment. Remind the person of confidentiality and IP obligations, ask them to confirm they hold no company data, and ask where any work data might be (personal email, cloud drives, home devices). Record the answers.
Issue a written reminder. A short letter or signed acknowledgement restating ongoing obligations. Under the UK Trade Secrets (Enforcement, etc.) Regulations 2018, information is a trade secret only if, among other things, reasonable steps were taken to keep it secret; consistent reminders help show that.
Confirm device return against the asset register: laptops, phones, security keys, smart cards and removable media. Keep high-risk leavers' devices unwiped until the review closes.
Review at T plus 30 days: check for any login attempts to disabled accounts, use of rotated credentials and access by the person's former tokens.

Evidence to preserve

Preserve before you wipe or reissue anything, and keep the chain of custody clean in case the matter goes to a tribunal or court. The eDiscovery and Legal Hold Guide covers holds in detail.

Evidence	Why it matters	Preservation step
Laptop and phone images	USB history, browser uploads, local copies	Forensic image before reissue; hash and log custody
Mailbox and cloud storage	Forwarding, sends to personal addresses, sharing links	Place on hold before the account is deleted
DLP, proxy and print logs	Exfiltration attempts and volumes	Export for the look-back window; logs age out
CRM, code platform and file share audit logs	Exports and clones of crown-jewel data	Export with timestamps and user identifiers
HR file, contracts and signed policies	What the person agreed and was told about monitoring	Copy into the case file
Exit interview notes and signed acknowledgement	Statements about data held	Signed and dated original

Notification triggers

Personal data taken: a departing employee taking customer or employee personal data without authorisation is a personal data breach. Under UK GDPR and EU GDPR Article 33, notify the supervisory authority within 72 hours of becoming aware unless it is unlikely to result in a risk to individuals; Article 34 adds notice to individuals when the risk is high.
Client or contractual data: contracts with clients often require prompt notice when their data leaves your control, including through an employee.
Regulated sectors: financial, health and public sector regulators may expect notice of material insider incidents under their own rules; check sector obligations.
Criminal conduct: where theft is likely criminal, legal decides whether to involve the police, weighing that against civil remedies.

Lessons from incidents

The Coupang signing key breach began with a developer who left at the end of 2024 still holding a token signing key that was never revoked or rotated; months later it was used to forge tokens and reach data on about 33.7 million accounts, the figure Coupang first disclosed (Coupang disputes how much the attacker kept). Departure checklists must cover keys and secrets, not only accounts.
The Coinbase insider breach involved bribed support staff copying data on 69,461 customers; the insiders were dismissed, but only after the data had gone. Dismissal of someone suspected of misuse is a high-risk departure, and the look-back review is what finds out how much left before the decision.

Measuring the programme

Departure controls fail quietly, so measure them. Useful metrics, reviewed monthly by HR and security together:

Notice-to-rating time: working days from HR learning of a departure to a recorded risk rating. Target one day.
Look-back coverage: share of high-risk leavers with a completed, documented look-back review. Target 100%.
Access removal lag: time from the planned removal point to the last successful sign-in on any system, including SaaS outside single sign-on.
Secrets rotated: share of shared credentials and keys in the leaver's scope rotated within one day of exit.
Device recovery: share of assigned assets returned within five working days of the last day.
Findings rate: look-back reviews that found unexplained copying, tracked by department, which shows where controls such as DLP need tightening.

Small and large organisations

A small business without insider risk tooling can still run this playbook: HR emails security on every resignation, a named person checks the mail admin centre for forwarding rules and the file platform's sharing report, and the manager collects devices on the last day. Large organisations should automate the trigger through an HR connector or the joiner-mover-leaver workflow, keep the look-back in a case management tool with restricted access, and give works councils or employee representatives early sight of monitoring practices where local law requires consultation. In every size of organisation, keep the departure panel small and access to case files need-to-know: most leavers are innocent, and the process must not treat them as suspects.

Framework mapping

Playbook step	NIST SP 800-53 r5	Other references
Access removal timing and retrieval of devices	PS-4 Personnel Termination	CISA insider threat framework: manage
Role change and partial removal	PS-5 Personnel Transfer, AC-2 Account Management	Joiner-Mover-Leaver Guide
Confidentiality and exit acknowledgements	PS-6 Access Agreements	UK Trade Secrets Regulations 2018, reg. 2
Look-back review and log review	AU-6 Audit Record Review	ICO monitoring workers guidance
Removable media restrictions	MP-7 Media Use	ATT&CK T1052.001
Insider incident handling	IR-4 Incident Handling	NIST SP 800-61 Rev. 3

Practitioner checklist

Make HR notify security of every resignation and dismissal within one working day, with role and destination.
Rate each departure low, medium or high using access, destination and circumstances, and record the rating.
Confirm the privacy notice covers the monitoring you plan, and complete a DPIA for anything new or intrusive.
Run a look-back review over a defined window for high-risk leavers and document the method.
Remove crown-jewel access at notice for high-risk leavers and coordinate full removal with the exit meeting.
Rotate shared credentials, API keys and signing keys the person could read.
Preserve devices, mailboxes and logs before any wipe or deletion.
Hold an exit interview with a security segment and get a signed acknowledgement of ongoing obligations.
Check for access attempts and token use at T plus 30 days.

Departing Employee Data Protection Playbook: Protect Data When Staff Leave