The Departing Employee: Protecting the Business on the Way Out

Triage: who is this, and where are they going?

Not every resignation needs this playbook. Run it when the person had real access — to trade secrets, source code, pricing, customer relationships, or sensitive systems — and the destination raises questions. The risk is highest when the move is to a direct competitor, to a customer, or to a venture the person is starting. Decide the tier in the first hours; it sets how much of what follows you actually do.

• Pull every agreement the person signed. Offer letter, confidentiality/NDA, IP-assignment, non-compete, non-solicit (of customers and of employees), and any equity or bonus clawback terms. Find the executed versions, not the templates — what they actually signed is the only thing that matters.
• Read the covenants against current law before relying on them. Enforceability of non-competes varies sharply by state and is actively in flux; several states limit or ban them outright, and the standards keep moving. Non-solicits and confidentiality terms generally travel better, but not everywhere. Confirm against the current rule in the governing state before threatening anything.
• Confirm where they are going, and in what role. A lateral move to a non-competing function is a different problem from a same-territory sales role at a rival. Map the new role to the specific obligations it would implicate.

Preserve before you touch anything

This is the phase that gets skipped under time pressure and cannot be recovered. The forensic window is short, and routine IT hygiene — reimaging, reassigning, wiping — destroys the best evidence you will ever have.

• Freeze the IT reissue process for this person immediately. One email to IT: do not wipe, reimage, reassign, or factory-reset the laptop, phone, or any account. Park the hardware; do not redeploy it.
• Forensically image the laptop, phone, and accounts. A defensible bit-for-bit image — ideally by a qualified examiner, with chain of custody — before anyone logs in to “just check.” Casual browsing alters metadata and access times you may later need. Limit this to company-owned devices and accounts; before imaging a personally-owned phone or device, or a personal account (see below), confirm ownership and your consent or policy authority, because imaging personal property or accounts carries its own legal exposure.
• Preserve the back-end logs, not just the device. Email, cloud storage, VPN, badge/door, code repositories, CRM, and DLP logs all live on the company side and age out on their own retention clocks. Identify them and hold them now.
• Capture personal-account touchpoints you can see. Note any personal email, cloud, or messaging accounts that appear in your logs. You cannot seize them, but knowing they exist shapes both the investigation and any later demand.

Investigate the access

The question is narrow: in the final weeks, did this person move company information somewhere it should not be? Most of the answer lives in the artifacts you just preserved.

• Review downloads and file activity in the final weeks. Spikes in volume, bulk exports, and access to material outside the person’s normal scope — the “why was she pulling the whole customer list” pattern.
• Check removable-media and USB history. External drives connected, what was copied, when. Often the cleanest single indicator of intent.
• Trace email-to-personal-account and forwarding. Messages and attachments sent to personal addresses, auto-forward rules, and large or unusual outbound attachments in the run-up to resignation.
• Look at cloud uploads and sync. Personal cloud drives, file-sharing links, and sync clients installed late in tenure. Movement off the managed perimeter is the thing to find.
• Keep the investigation channeled through counsel. Run the analysis so the work product and conclusions can be protected, and so findings are framed by someone who knows what is and isn’t actionable. Privilege cannot be retrofitted after the fact.

Manage access and secure the relationships

Two competing pressures: cut off access before anything else walks out, but not so abruptly that you tip off a person you are still quietly investigating. Plan the timing deliberately.

• Build a staged credential-disablement schedule. Map every system and pick a cutover time — commonly the end of the last working session. Too early tips your hand and may be premature if the person stays through a notice period; too late leaves the door open. Coordinate, don’t improvise.
• Reset shared and service credentials the person knew. Shared logins, API keys, admin passwords, and anything they could still reach from outside. Individual accounts are only half the exposure.
• Plan the customer-transition message before the news spreads. Decide who owns each key account, who calls the customer, and what is said. A clean, prompt transition is itself a defense to claims of solicitation and disruption later.
• Reassign accounts and introduce the successor early. The longer a relationship sits “belonging” to a departed person, the easier it is to move. Visible continuity protects the relationship and the record.

The exit conversation and what follows

• Use a written exit acknowledgment. A short document the person signs at departure, reminding them of continuing confidentiality, return-of-property obligations, and any non-solicit or non-compete terms — with the agreements attached. It removes the “I didn’t know I was still bound” defense and confirms what was returned.
• Decide whether a reminder letter is warranted. Where the destination genuinely implicates the covenants, a measured letter to the departing employee — and sometimes to the new employer — restating the obligations can prevent a problem without litigation. Keep it factual; an overbroad or threatening letter where the covenant is weak invites a declaratory-judgment suit and bad optics.
• If misappropriation is suspected, issue a litigation hold and involve counsel now. Trade-secret matters move fast — injunctive relief is often the whole point — and spoliation by the company is an avoidable own-goal. See Litigation Hold: Trigger to Release.
• Mind the mirror image when you are the one hiring. The same diligence protects you when you are the new employer receiving someone else’s departing employee — review their covenants, run a clean-hands onboarding, and enforce a do-not-bring-it-with-you rule. See Hiring From a Competitor.