When someone leaves a business, the visible part of offboarding is straightforward: collect equipment, notify colleagues and close payroll tasks. The digital part is harder. A single Google Workspace account may own customer files, recurring calendar events, automated reports, shared credentials, third-party applications and years of business context. Deleting the account too early can remove […]
When someone leaves a business, the visible part of offboarding is straightforward: collect equipment, notify colleagues and close payroll tasks. The digital part is harder. A single Google Workspace account may own customer files, recurring calendar events, automated reports, shared credentials, third-party applications and years of business context.
Deleting the account too early can remove access to information the organisation still needs. Leaving it active for too long can create a security and privacy risk. A dependable process must therefore do more than suspend a login. It must preserve business continuity, establish a lawful retention decision and prove that access has been removed.
The following checklist gives business leaders, HR teams and administrators a practical way to coordinate that work.
Begin with ownership, timing and authority
Every departure has a business owner. Usually that is the employee’s manager working with HR and IT. Before technical changes begin, confirm the person’s final working time, whether the departure is planned or immediate, and who is authorised to receive their business information.
This matters because IT should not independently decide which mailbox, files or messages another employee may access. HR, management and—where appropriate—legal or privacy specialists should define the business purpose and retention period. IT then implements the approved decision and records what happened.
Create one offboarding ticket with named owners, the exact cut-off time and an evidence checklist. For urgent departures, access containment comes first; data classification and transfer can follow under controlled access.
Secure the account and active sessions
At the agreed time, suspend the user so they cannot sign in. Then address the paths that may remain active beyond a password change.
Review authentication and recovery
Reset or invalidate sign-in credentials, recovery methods and application-specific passwords as appropriate. Remove security keys, passkeys and enrolled verification methods from the former employee’s control. Review delegated mailbox access and any administrative roles separately; suspension alone is not a substitute for checking privileged access.
Revoke sessions and connected applications
Users often authorise third-party tools using “Sign in with Google” or OAuth. Review connected applications, tokens and mobile sessions, particularly where the account accessed CRM, finance, source-code, support or HR systems. The same offboarding ticket should cover applications outside Google Workspace, because an identity may have been used across the wider technology estate.
Protect managed devices
Record laptops, phones, security keys and other equipment. If endpoint management is enabled, apply the organisation’s approved sign-out, account-removal or wipe procedure. A personal device may require removal of business data rather than erasure of the entire device. The correct action depends on ownership, configuration and policy.
Preserve information before deleting anything
Business data should have a destination and an accountable owner. “Keep everything forever” is not a sound retention policy, but neither is deleting first and investigating later.
Transfer My Drive content
Identify files owned by the departing user and transfer required ownership to an appropriate manager or service owner. Do not simply send everything to a general administrator and leave it there. The receiving owner should review, classify and relocate important content into a team-controlled structure.
Google’s shared drives are valuable here because files belong to the organisation rather than an individual. When a member leaves, content stored in a shared drive remains with the team. That makes shared drives a preventive governance measure, not merely an offboarding tool.
Decide how email and calendar information will be handled
Determine whether business email needs to be retained, delegated, exported or archived under an approved policy. Redirecting all future mail indefinitely can expose personal or confidential information and hide an unresolved ownership problem. A time-limited response, monitored shared address or updated customer contact may be more appropriate.
Review calendars, recurring meetings, room bookings and resources owned by the account. Transfer responsibility for continuing events so customers and colleagues do not depend on an inaccessible organiser.
Account for groups, sites and automations
Check Google Groups ownership, shared inboxes, Google Sites, Apps Script projects, scheduled reports, forms and integrations. A workflow can fail weeks after departure if its trigger, credential or destination belonged to one person.
Choose archive, deletion or another retention path
The final account state should reflect a documented business and legal decision.
Archiving can retain a former employee’s Google Workspace data while preventing access to Workspace services, subject to the organisation’s edition and licensing. Archived-user data still consumes pooled storage. Deletion may be suitable once required information has been transferred and the retention obligation has ended. In some circumstances, an investigation, legal hold or regulatory requirement may change the available options.
Avoid turning suspended accounts into permanent, unmanaged archives. Set a review date and record who owns the decision. Retention should be consistent, proportionate and connected to the organisation’s privacy and records policies.
Validate the result instead of assuming success
A completed checklist should answer five questions:
- Can the former employee still authenticate through any known route?
- Does an authorised owner control the business information that must remain?
- Have critical meetings, groups, forms, scripts and connected systems been reassigned?
- Has equipment and endpoint access been resolved?
- Is the final retention or deletion decision recorded with a review date?
For higher-risk roles, ask a second administrator to review the evidence. Finance, HR, executive, IT-administration and development accounts deserve additional scrutiny because their access tends to be broader and their automations more consequential.
Turn offboarding lessons into better governance
Repeated offboarding problems reveal weaknesses in normal operations. If every departure requires a search for personal file ownership, move important work into shared drives. If automations repeatedly stop, introduce service accounts and documented owners where technically and contractually appropriate. If access reviews are difficult, improve group-based permissions and maintain an application inventory.
Measure the process with useful operational indicators: time from approved cut-off to suspension, percentage of assets with confirmed owners, overdue equipment returns, unresolved third-party access and accounts awaiting final retention review. The aim is not to count completed tickets; it is to reduce residual risk and disruption.
A practical next step
Choose one recent departure and reconstruct the process. Can you show when access ended, where the person’s files went, who owns their recurring workflows and when retained data will be reviewed? Any uncertainty becomes a concrete improvement for the next offboarding.
Kashinbu helps organisations in India plan Google Workspace governance, administration and managed operational processes, including secure onboarding, offboarding and information ownership. If your current process depends on memory or manual improvisation, we can help turn it into a documented, repeatable control.
Suggested internal links
- Google Workspace licensing or managed-service page
- Managed IT and system support service page
- Cybersecurity service page
- India technology services page
- Contact or consultation page
Editorial references
- Google Workspace Admin Help: archive former employee accounts
- Google Workspace Learning Center: shared drives and team-owned files
- Google Workspace administration guidance for transferring user data
Turn the insight into a practical plan.
Discuss your goals with a Kashinbu specialist and identify the next useful step.
