# What Happens to Company Files When an Employee Leaves? A Step-by-Step Guide to Access, Handover and Retention

> Stop company files going missing or walking out when someone leaves: a step-by-step guide to revoking access, handover, shared links and retention.

Source: https://digitalbridge.com.tr/en/blog/company-files-when-employee-leaves.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-10-23 · Updated: 2026-10-23

When an employee leaves, company files should stay with the company and the leaver's access should end on their last working day. That depends on files living in department areas rather than personal folders, access being tied to roles rather than names, external sharing links being revoked and the handover following a written checklist.

## Key takeaways

- Files created for the business belong to the business; they should not remain in a leaver's personal cloud account, phone or USB stick.
- Disabling the login is not enough: external sharing links, synced devices and email attachments need checking too.
- If files sit in department areas with role-based permissions, leaving day becomes "close the account", not "find the files".
- Records with a retention duty (commercial documents, personnel files) must not be deleted; personal data should be kept only as long as the purpose requires.
- Reviewing the last 30 days of downloads and sharing is the most practical way to spot a leak early.

Most companies have a routine for a leaver's mailbox, but few think about their files, even though proposals, customer lists and contracts usually live in shared drives and personal cloud accounts. This guide covers the steps that keep them from being lost or leaving unchecked.

## Why are company files at risk when someone leaves?

The usual cause is not malice but sprawl. Files are scattered across a desktop, a personal cloud account, a folder on the shared drive created under someone's own name and a trail of email attachments. Because nobody can see in one place who has access to which folder, there is no clear answer on leaving day to the question "what exactly do we need to shut down?"

The second risk is accounts left open. An active account is an open door for password attacks even if the former employee never touches it again. According to the [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf), the use of stolen credentials held steady as an action in 36% of breaches.

Identity-related incidents are common across the board. Sophos' [The State of Identity Security 2026](https://www.sophos.com/en-us/press/press-releases/2026/05/71-percent-organizations-suffered-identity-breach-state-of-identity-security-2026) survey of 5,000 IT and security leaders in 17 countries found that 71% of responding organisations had suffered at least one identity-related breach in the past year. In Türkiye, the [KVKK 2025 Annual Report](https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5ZjMxYTVlZGY0Y2Y.pdf) shows the data protection authority received 328 breach notifications in 2025, and a folder of personal data left in the wrong hands can become one of them.

The third cost is quieter: lost knowledge. A proposal whose latest version sat on the leaver's laptop, a half-finished contract or a folder structure only they understood can turn into weeks of searching and redone work. We cover why files belong in one managed place in our [business document management guide](https://digitalbridge.com.tr/en/blog/business-document-management-guide.html).

## Who owns a leaver's files, and what must be kept?

Proposals, reports, drawings and correspondence produced in the course of employment are, as a rule, business assets and stay with the company. Writing this into the employment contract, a confidentiality undertaking or the information security policy avoids arguments at the exit interview. The employee's genuinely personal files (private photos, personal documents) should be handed back to them and removed from company systems.

Retention follows two different logics. For companies operating in Türkiye, Article 82 of the Turkish Commercial Code requires commercial books and commercial documents sent or received to be kept for ten years, so invoices, contracts and correspondence in a leaver's folders must not be "tidied away". Personal data, by contrast, should be kept only as long as the purpose requires under the Personal Data Protection Law ([KVKK](https://digitalbridge.com.tr/en/glossary.html#kvkk)); our [data retention and disposal policy](https://digitalbridge.com.tr/en/blog/data-retention-disposal-policy.html) guide explains how to set those periods in advance.

The leaver's own personnel file is a separate matter. Employment contracts, payroll and training records are retained for the statutory periods, but access should be limited to HR and authorised managers. Our guide to [employee personal data under KVKK](https://digitalbridge.com.tr/en/blog/employee-personal-data-kvkk.html) covers this in detail.

## How do you hand over files step by step?

Offboarding should start the day IT and the line manager learn of a resignation or dismissal, not on the last day. The sequence below keeps files from going missing and makes sure access closes on time.

1. **Take an inventory:** list the folders, shared drives, cloud accounts, external sharing links and company devices the person uses.
2. **Name a successor:** assign an owner for each workstream (client files, proposals, projects) and record the handover with the line manager.
3. **Move files out of personal spaces:** transfer work files from the desktop, personal folders and personal cloud accounts into the right department folder, and agree with the leaver which version is final.
4. **Review recent activity:** check the last 30 days of bulk downloads, external shares and deletions, and raise anything unusual with legal and management.
5. **Revoke access on the last day:** remove access to file storage, email, VPN and cloud services on the same day, and change any shared passwords.
6. **Cancel sharing links:** shut down links the person opened to outsiders, or hand them to the new owner.
7. **Recover devices:** collect laptops, phones and external drives against a signed receipt, then wipe company data or rebuild the device.
8. **Hold off on deletion:** even after the account is closed, keep the files archived until retention periods and any disputes are clear.

Use this list alongside our guide to [offboarding email access](https://digitalbridge.com.tr/en/blog/offboarding-email-access.html), which covers mailbox handover, forwarding and auto-replies. If something is deleted by mistake along the way, see [how to recover deleted company files](https://digitalbridge.com.tr/en/blog/recover-deleted-company-files.html).

## Which channels need closing off?

Files live in several places, so access has to be closed in each. The channels most often missed:

| Channel | Typical risk | What to do on leaving day |
|---|---|---|
| Shared drive / file server | Individually granted folder permissions are forgotten | Remove personal permissions and move to role-based access |
| Personal cloud account | Work files sit in an account the company cannot see | Move files into company storage and ban personal accounts for work |
| External sharing links | Links sent to clients or suppliers stay live for months | Revoke them or reassign them to the new owner |
| Email attachments | Contracts and proposals exist only in the mailbox | Save key attachments to the document store |
| Synced devices | Local copies remain on laptops and phones | Collect the device and wipe company data |
| Shared passwords | Accounts everyone knows stay open | Change passwords and move to named accounts |

The first two rows cause most of the trouble. We explain how to tie folder rights to roles rather than individuals in [file sharing permissions](https://digitalbridge.com.tr/en/blog/file-sharing-permissions.html), and compare personal cloud storage with managed storage in [Google Drive vs business file management](https://digitalbridge.com.tr/en/blog/google-drive-vs-business-file-management.html).

## How can you spot and limit file copying by a leaver?

You cannot rule it out entirely, but you can shrink the risk considerably. The most effective control is for people never to have access to more files than their job needs; this least-privilege principle limits what a pre-departure bulk download can take in the first place. The second control is an activity log showing who downloaded what, and when.

Hundreds of files downloaded in a few minutes, or external links created late at night, are signals worth watching during a notice period. For broader technical controls, see our guide to [data loss prevention (DLP)](https://digitalbridge.com.tr/en/blog/data-loss-prevention-dlp.html) and the [DLP glossary entry](https://digitalbridge.com.tr/en/glossary.html#dlp).

## How does SmartFiles make this easier?

[SmartFiles](https://digitalbridge.com.tr/en/smart360/smartfiles.html), part of Digital Bridge's Smart360 family, gathers an organisation's files into department-based storage areas instead of personal folders. Permissions are granted to individuals or departments; anyone who joins a department inherits its rights, and when a person is removed from the organisation their permissions are cleared automatically. Because users and departments are defined once in the Smart360 panel, nobody has to hunt for individual folder permissions on leaving day.

Take a concrete case. Emre, a procurement specialist, is leaving in two weeks. His manager downloads the Procurement area's activity history as a CSV and reviews recent downloads and shares, while SmartFiles itself flags unusual activity such as more than 100 downloads in ten minutes or an external link created between 22:00 and 06:00. Because Emre's files already live in the department area, his successor simply carries on in the same folders; the moment Emre is removed in Smart360, his access ends and any external links he created stop working.

There is a safety net for retention too. SmartFiles keeps a version history for every file, deleted items wait in the bin for a period the organisation sets (30 days by default), and folders can be given a retention period of 1 to 30 years; expired documents are listed for the owner rather than deleted automatically. An administrator can also place a legal hold on documents that may be needed in a dispute, so they cannot be deleted or moved.

For organisations that also use SmartMail, contracts and proposals that exist only as attachments can be saved to a department area straight from the attachment card, so they no longer depend on the leaver's mailbox. Full details on versions, permissions and sharing are on the [SmartFiles product page](https://digitalbridge.com.tr/en/smart360/smartfiles.html).

## How can Digital Bridge help?

Digital Bridge treats offboarding as a business process, not just a software setup. We review your current shared drives and cloud folders, design department areas and a role-based permission matrix with you, and plan the migration and initial configuration of SmartFiles. For the wider product family, see the [Smart360 page](https://digitalbridge.com.tr/en/smart360.html).

On retention periods, access to personnel files and leavers' personal data, our [data protection compliance](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html) team reviews your retention and disposal policy, offboarding checklist and access logs with you.

## Next step: test your offboarding process today

Think of the last person who left and ask yourself: could you show, within five minutes, where their files are, who took them over and on which day their access ended? If not, start by adapting the eight steps above to your own company. More guides on email and document security are collected under [Business Email and Documents](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

To keep files in department areas and close a leaver's access in one step, explore the [SmartFiles product page](https://digitalbridge.com.tr/en/smart360/smartfiles.html). You can buy SmartFiles on the [Smart360 purchase page](https://smart360.com.tr/satin-al?urun=smartfiles), or [contact us](https://digitalbridge.com.tr/en/contact.html) about migration and setup.

## Frequently Asked Questions

### Should a leaver's files be deleted?

No, not straight away. Files created for the business belong to the company and should pass to whoever takes over the work. Commercial records such as invoices and contracts carry statutory retention periods, while personal data should be destroyed once the period in your retention policy ends. Keeping files archived for a while after the account closes protects the company in disputes and when forgotten tasks resurface.

### When should a leaver's access be revoked?

At the latest, at the end of their final working day. In dismissals or high-risk roles it is safer to revoke access as soon as the person is informed. Before that point, the handover should be done, files in personal spaces moved into department folders and any links shared outside the organisation reviewed, so nothing important is locked away with the account.

### What if an employee copied company files to a personal account?

First, use your logs to establish which files were copied and when. Then ask the person in writing to delete them and confirm that they have done so. Where personal data or trade secrets are involved, work with your legal adviser, and if a personal data breach is suspected, assess whether the notification duty under KVKK applies. Keep a record of every step you take.

### How should access change when someone moves department?

A department move is a small departure in its own right. Access to the old department's folders should be removed and access matching the new role granted. If permissions were granted to departments rather than individuals, this happens automatically; any exceptional rights given to the person directly still need a separate review, as they are the ones most often left behind.

### Are a leaver's files lost in SmartFiles?

No. In SmartFiles, files belong to the department area, not to the person. When someone is removed from the organisation only their permissions are cleared; the files stay in the area and the successor keeps working in the same folders. Deleted items wait in the bin for the period the organisation sets, and every file keeps its version history.

### Do we really need a written offboarding checklist?

Yes. A written checklist stops offboarding from depending on one person's memory. It should cover the inventory, the successor, access removal, sharing links, device return and retention. Signing it off for each leaver helps in internal audits and in showing the technical and organisational measures expected under KVKK, and it makes gaps visible the next time someone leaves.