Someone is leaving. The HR paperwork is done, the leaving drinks are booked, and three weeks later somebody notices that their email address is still receiving orders, their account is still active in the invoicing software, and nobody knows who has the password to the Facebook page they used to run.
In a small business, a departure is rarely prepared on the IT side, because it doesn't happen often enough for anyone to have a method. That is exactly why it is worth writing one down, once. Here is the checklist I would suggest for a business of a handful to a few dozen people.
1. Before they leave: list everything the person touches
Start from what they actually did in the last few weeks, not from their job description. List the tools where they have an account in their own name, and the ones where they use a shared login:
- email, calendar, file storage (Microsoft 365, Google Workspace);
- business software: ERP, accounting, CRM, till, scheduling;
- online banking and company payment cards;
- company social media, website, domain name, hosting;
- physical access: keys, badge, alarm code;
- equipment: laptop, phone, security key, external drive.
If that list is hard to write, take it as a signal: the business probably lacks an inventory of its own accounts. The post on who really holds your business's keys gives a simple way to keep one.
2. Before they leave: hand over the work
The right time to collect what the business needs is before the last day, with the person in the room. Ask them to move working documents out of their personal space (OneDrive, My Drive) into a shared team folder, to reassign their open tasks, quotes and appointments, and to write down the next actions: the customer to call back, the payment that is due, the file that is stuck.
Use the handover to spot what runs in their name without anyone seeing it: a mail forwarding rule, an automation, a subscription paid with their card, a single admin account. Those are the details that break a month later.
3. On the last day: cut access, not just the password
Changing the password is not always enough: a session already open on a phone or in a browser can stay active. In both Microsoft 365 and Google Workspace, an administrator can block sign-in and sign the user out of every session. Do it at the agreed time, then:
- remove admin rights and access to shared mailboxes;
- deactivate their account in every business application on the list;
- change the passwords of any shared accounts they knew, Wi-Fi included, and use the occasion to move those to named accounts or a password manager;
- remove their device from the approved devices, and wipe company data from their personal phone if they had work email on it;
- collect the equipment and keys.
4. The mailbox: Belgian rules are stricter than the usual reflex
The common reflex is to keep the mailbox open and forward everything to a colleague "so nothing gets missed". Belgium's Data Protection Authority (APD/GBA) takes a clear line on this, repeated in several decisions of its Litigation Chamber since 2020:
- no later than the actual leaving day, the mailbox is deactivated and an automatic reply tells senders the person no longer works there, with the name or generic address to contact instead;
- that reply stays in place for a reasonable period, in principle one month, which can be extended to three months at most depending on the role, with a reason and preferably with the former employee's agreement;
- the person is told about the deactivation;
- after that, the mailbox and the automatic reply are deleted;
- mail addressed to them is not forwarded to a colleague who would read it.
The same rules apply when you stop working with a freelancer. Note that some vendors' own offboarding guides suggest forwarding to a colleague or converting the mailbox into a shared one. It is technically possible, but in Belgium it is not the right practice. A generic address shared by the team (info@, orders@) avoids much of the problem next time someone leaves.
5. The next day: check
Something always gets forgotten on the day. The following morning, take ten minutes to check that the account no longer shows as active, that no forwarding rule is left, that the shared files open for the person taking over, and that the licence has been removed or reassigned. A forgotten licence keeps being billed every month.
6. Do it twice, automate it
Once the list is written, don't leave it in a document nobody will find. If you use Odoo, the Employees app has an editable "Offboarding" activity plan: each step becomes an activity assigned to the right person with a due date, launched from the employee's record. Without Odoo, a simple template task list does the job. What matters is that the next departure starts from that list rather than from someone's memory. It is the same idea as in if you do it twice, automate it.
And think about the other direction: the same list, turned around, becomes your onboarding checklist. What you open when someone arrives, you know how to close when they leave.
If you'd like to write this checklist with someone who knows Microsoft 365, Google Workspace and Odoo, or turn it into a plan inside Odoo, that is typically the kind of work we do in an hour pack: info@z80.be or +32 494 111 041.