# Employee Offboarding Accounts Checklist: How to Close Email, File, App and Access Card Accounts

> How to close a leaver's email, file storage, software, social media and access card accounts: an account inventory, the right order and a KVKK checklist.

Source: https://digitalbridge.com.tr/en/blog/offboarding-all-employee-accounts.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Cyber Security & Compliance
Published: 2026-10-23 · Updated: 2026-10-23

Offboarding an employee's accounts means disabling every identity they used on the company's behalf (email, file storage, business software, admin panels, social media, physical access cards) at the end of their last working day, handing the content to a named owner and recording it all. The hard part is not switching accounts off but knowing every account exists, so offboarding really starts with an account inventory kept from day one.

## Key takeaways

- The foundation of a clean leaver process is an up-to-date inventory of each employee's accounts and permissions, started when they join.
- Close sessions and access first, hand over content second, and archive or delete the account last; change the order and you lose either data or security.
- Shared passwords, software accounts opened with personal email addresses and unreturned access cards are the items most often missed.
- Under KVKK, Turkey's data protection law, a leaver's personal data is handled according to your retention and disposal policy; closing an account is not the same as deleting the data.
- On a single sign-on platform, access closes in one place; with scattered systems, each one has to be closed separately.

## Why are a leaver's open accounts a risk?

An account left open is usually the product of forgetfulness rather than malice. A phone still signed in to email, a courier portal registered to a personal address, a former marketer still admin of the company's social media, an uncollected access card: each leaves a door ajar. Once the leaver's password leaks, whoever uses the account is an attacker.

In the [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf), use of stolen credentials appeared as an action in 36% of breaches. An account nobody closed is exactly where such credentials still work.

[Sophos' State of Identity Security 2026 survey of 5,000 IT and security leaders in 17 countries](https://www.sophos.com/en-us/press/press-releases/2026/05/71-percent-organizations-suffered-identity-breach-state-of-identity-security-2026) found that 71% of organisations suffered at least one identity-related breach in the past year, while only 24% continually monitor for unusual login attempts. In most organisations, then, a sign-in to a forgotten account goes unnoticed.

The cost is not only a security one. Correspondence, client files and supplier records that leave with an account disrupt business continuity, and an unmanaged mailbox full of personal data bears directly on your obligations around [employee personal data under KVKK](https://digitalbridge.com.tr/en/blog/employee-personal-data-kvkk.html).

## Which accounts belong in the inventory?

Record every account as it is created at onboarding rather than trying to remember them on the leaving day. The table below covers the account types most smaller firms run.

| Account type | Typical risk | Offboarding action | Owner |
|---|---|---|---|
| Business email and shared mailboxes | Open mobile session, external forwarding rule, shared mailbox password | End sessions, remove rules, hand over the mailbox | IT / manager |
| File storage and sharing links | Documents copied to personal cloud, public links | Remove permissions, transfer file ownership | IT / department head |
| Business software (accounting, CRM, ERP, e-commerce panel) | Account opened with personal email, admin role | Deactivate the user, reassign the role | Application owner |
| Social media and ad accounts | The leaver is the only admin | Transfer admin rights, remove the person | Marketing |
| Domain, hosting, banking and government portals | Password or authority held by one person | Change passwords, withdraw authority | Management / finance |
| Card access control and time attendance | Unreturned card still valid at the doors | Cancel the card, deactivate the person | HR / facilities |
| Devices and shared passwords | Laptop, phone, Wi-Fi and shared account passwords | Collect devices, rotate shared passwords | IT |

The most dangerous row is usually "shared passwords". If five people know a password, all five need a new one when one of them leaves, which is why, as our [business password security](https://digitalbridge.com.tr/en/blog/business-password-security.html) guide explains, access should be tied to people rather than passwords.

## In what order should a leaver's accounts be closed?

Order matters: delete an account before its content is handed over and the correspondence is gone; wait for the handover before closing access and the account stays open for days. The steps below run from the resignation notice to the week after.

1. **Tell IT on the day the departure is known.** Without a written HR-to-IT notification step, everything gets squeezed into the last day.
2. **Pull the account inventory.** List every account, shared mailbox, admin panel and card the person holds.
3. **Name the handover owner.** Who takes over the mailbox, files and open work should be agreed in writing before the last day.
4. **Close access at the end of the last working day.** Changing the password is not enough; end active sessions and remove the person's [multi-factor authentication](https://digitalbridge.com.tr/en/blog/multi-factor-authentication-business.html) devices. If the phone has not been returned, apply the steps in [closing sessions on a lost phone](https://digitalbridge.com.tr/en/blog/lost-phone-open-company-sessions.html).
5. **Clear forwarding rules and sharing links.** External forwarding and public links can leak data even after the account is closed.
6. **Rotate shared passwords and cancel cards.** Change every shared password the person knew and cancel their access card.
7. **Hand over content, then archive the account.** Move correspondence and files to the new owner, then archive or delete the account under your retention policy.
8. **Record it and check again a week later.** Note who closed what and when; after a week, review sign-in logs to confirm nothing was left open.

For the email detail, see our guide to [offboarding email access](https://digitalbridge.com.tr/en/blog/offboarding-email-access.html); for where documents should end up, read [company files when an employee leaves](https://digitalbridge.com.tr/en/blog/company-files-when-employee-leaves.html).

## How should KVKK and retention duties be handled at offboarding?

Closing an account does not mean deleting what is in it; some records you are obliged to keep. Article 82 of the Turkish Commercial Code requires commercial correspondence to be kept for ten years; the full table is in our article on [company document retention periods in Turkey](https://digitalbridge.com.tr/en/blog/company-document-retention-periods-turkey.html).

At the same time, a leaver's personal data must be erased, destroyed or anonymised once the purpose of processing has ended, in line with your [data retention and disposal policy](https://digitalbridge.com.tr/en/blog/data-retention-disposal-policy.html). From a [KVKK](https://digitalbridge.com.tr/en/glossary.html#kvkk) perspective, offboarding is a balancing act: keep the commercial records, dispose of personal data you no longer need. Where you are unsure of a retention period, take legal advice.

## Why does offboarding break down with scattered systems?

In most organisations email, file storage, access control and business software come from different vendors, each with its own user list and passwords. If a leaver exists in seven systems, that is seven separate actions on seven screens, and the odds of missing one are high.

The core fix is [single sign-on (SSO)](https://digitalbridge.com.tr/en/blog/single-sign-on-sso-benefits.html) and central identity management: a person is set up once, signs into every application with the same identity, and when that identity is closed, access ends everywhere.

## How does Smart360 make this easier?

Smart360 is a family of business applications that brings SmartMail, SmartFiles, SmartOperator and SmartPass together in one ecosystem managed from a single panel. Staff sign into every product with one identity (SmartID), and when someone leaves, the administrator closes their access in one place, however many products they used.

Take a concrete case: an accounts clerk is leaving a logistics firm. They work in the `accounts@` shared mailbox in SmartMail, keep supplier contracts in SmartFiles and open the office door with a SmartPass card. When the administrator closes their access in the [Smart360 organisation panel](https://digitalbridge.com.tr/en/smart360.html), the following happens:

- **Department access drops automatically.** Access a person received through a department is removed in every product when they leave it, and the related mailboxes and areas disappear from any open screen immediately.
- **Sessions close remotely.** Open sessions are listed with device details; a single device or all other devices can be signed out remotely, and a password change ends sessions on every device.
- **The shared mailbox password stays the same.** The system generates mailbox passwords and never hands them to staff; access is a permission, not a password, so the rest of the team has nothing to relearn.
- **Scheduled emails do not go out.** SmartMail rechecks a scheduled email at the moment of sending, so messages the leaver queued are not sent on the company's behalf.
- **The card stops opening doors.** In SmartPass the person is deactivated or the card cancelled; the change takes effect on the server at once and door permission lists update within seconds.
- **Files stay with the company.** SmartFiles keeps documents in department storage areas with no overwriting and a version history, so nothing depends on the leaver's laptop.

On the KVKK side, the organisation panel documents a step for deleting an employee's personal data; when a person is deleted in Smart360, their name and personal details in SmartPass are erased and the card is cancelled, while the numerical reports remain. You can explore the whole product family on the [Smart360 page](https://digitalbridge.com.tr/en/smart360.html).

## How can Digital Bridge help?

A secure leaver process is not just a software matter; it needs an inventory, named owners and a record. Through our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html), Digital Bridge maps your existing accounts, finds shared passwords and lingering permissions, and writes up your joiner and leaver workflow.

For retention and disposal periods, employee data and privacy notices, we offer [data protection compliance consultancy](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html). When Smart360 is set up, the initial configuration of users, departments, shared mailboxes and storage areas is done with guidance from the Smart360 team, and existing files are migrated with their folder structure intact. For a broader starting point, our [SME cyber security checklist](https://digitalbridge.com.tr/en/blog/sme-cyber-security-checklist.html) is a good frame.

## What should the next step be?

This week's task: take the list of everyone who left in the past year and compare it against the table above; every account still open shows you where to start. Then add an account inventory line to your onboarding form.

If you want to open and close access from one place, you can choose a package and get started on the [Smart360 purchase page](https://smart360.com.tr/satin-al), or compare the products first on the [Smart360 page](https://digitalbridge.com.tr/en/smart360.html). To review your own set-up with us, get in touch via our [contact page](https://digitalbridge.com.tr/en/contact.html); every related article sits under [Cyber Security & Compliance](https://digitalbridge.com.tr/en/blog/topic/guvenlik-kvkk.html).

## Frequently Asked Questions

### When should a leaver's accounts be closed?

The safest moment is the end of their last working day. Closing earlier complicates the handover, closing later leaves the account without an owner. In sudden departures, such as a dismissal, access should be closed at the moment of notice. The handover owner and content transfer should ideally be arranged before the last day, and the closure recorded with date and time.

### Should a leaver's email account be deleted straight away?

No. Access is closed first, then the correspondence is moved to the new owner or an archive. Commercial correspondence is subject to statutory retention periods, so deleting the mailbox immediately can cause data loss and compliance problems. An auto-reply or forwarding to the new owner can stay in place for a set period, after which the account is archived under your policy.

### Do shared passwords need changing when someone leaves?

Yes. Every shared password the leaver knew, whether for Wi-Fi, a shared mailbox, social media or a banking channel, should be changed. Because this repeats with every departure, the lasting fix is to tie access to individual accounts and permissions. That way one person leaving never forces the rest of the team to change their passwords.

### How long can a leaver's data be kept under KVKK?

There is no single period; the relevant law for each type of data and the purpose of processing decide it. Payroll, social security and commercial records are kept for the period their own legislation sets, while personal data whose purpose has ended is erased, destroyed or anonymised under your retention and disposal policy. Put the periods in a written policy and take legal advice where needed.

### How is a leaver's access closed in Smart360?

The administrator closes the person's access in one place in the organisation panel, regardless of how many Smart360 products they used. Access granted through a department is removed automatically across all products, and open sessions can be ended remotely. Because mailbox passwords are never given to staff, the team does not need to change any shared mailbox password.

### What if an access card is not returned?

Even if the card cannot be recovered physically, it should be cancelled in the access control system or the person deactivated. As long as the system still recognises the card number, doors may open. In cloud-based systems the cancellation takes effect on the server at once and reaches the doors shortly afterwards. Add the cancellation, with date and time, to the offboarding record.