Former Employees' Accounts: What to Stop, When, and in What Order — Timing and Checklist

Most owners know a former employee's accounts "should be deleted," but what is usually missing is when, what, and in what order. The short answer: stop the logins (disable) on the last working day, on the spot. Delete the accounts only after the handover and data checks are done. This guide explains why, with a checklist for each stage.

Why leaving accounts in place is dangerous

When a former employee's account still works, the system cannot tell that login from a current employee's. Whether the password has leaked, and whether or not the person means any harm, the door stays open.

In IPA's "10 Major Threats," information leakage by internal misconduct has been selected for organisations for more than ten consecutive years (7th in the 2026 edition). Osaka Prefectural Police also call for cleaning up former employees' accounts, after cases in which leftover access rights were misused to reach internal networks.

It is not only about the person who left. Accounts nobody uses are accounts nobody watches — an easy entrance for outside attackers as well.

"Disable" and "delete" are two different steps

Stopping an account has two stages:

• Disable (stop the login) — From that day, the account cannot log in. The data remains, so handovers and checks can still be done afterwards. Do this on the last working day, on the spot.
• Delete — Removes the account and its data. This cannot be undone, so it comes after the handover of business data and any retention checks are finished.

Deleting first can lock away the email and files you still needed to hand over. The order is: stop it first; delete after confirmation.

What to stop, and when (checklist by stage)

When the departure is decided

• List the services and accounts the person uses (email, chat, file sharing, attendance, accounting, social media, VPN, and so on)
• Check whether they hold any administrator rights

On the last working day

• Disable all of their accounts (stop the logins)
• Change the passwords of shared accounts (department email, company social media)
• Collect company keys, IC cards and loaned devices
• If they used company services on a personal computer or phone, have them sign out on the spot

The next business day to one week

• Decide where their email and files go, and move what is needed
• Check that no customer or partner contact point is still registered in their name

Around one month later

• Delete the accounts whose handover and retention checks are complete
• Record the disable date, delete date and who handled it in the list

Make the account review a habit

Handling each departure well still misses leftovers from the past. Every three months, compare "the list of people here now" with "the list of accounts." A simple spreadsheet is enough. Recording who checked, when, and what, is what makes it work later.

Summary: today's checklist

• Made the account list for the person leaving
• Decided the order: disable on the last day, delete after the handover
• Put shared-account password changes into the procedure
• Fixed a date for the quarterly account review

Check your understanding

Tap an answer to check yourself. Nothing is saved or sent.

Q1. What is the right order for stopping a former employee's account?

Delete it first, on the last dayDisable it on the last day; delete after the handover is completeWait a month, then disable it

See the answer

Deleting first can lock away email and files you still need to hand over. Stop the login first; delete after confirmation.

Q2. On the last day, is only the person's own account affected?

Yes, only their own accountsShared-account passwords must also be changedNo password changes are needed

See the answer

Passwords of shared accounts the person knows — department email, company social media — are changed on the last day too.

Q3. How often should accounts be reviewed?

Only when someone leavesRegularly, e.g. every three monthsOnce a year at closing

See the answer

Per-departure handling misses older leftovers. Fix a rhythm, such as every three months, and compare against the list of current staff.

Read next

See the latest threat intelligence

Start Here — security in 3 steps

← Back to the guide list