When someone leaves your business, their email address may still receive enquiries, invoices and replies from clients. You need continuity, but that does not mean keeping the former employee’s access active or allowing unrestricted access to their messages. A clear process separates three tasks: removing access, handing over responsibilities and retaining correspondence for a defined purpose.
For a small business, this process can be straightforward. What matters is deciding who takes action, when access ends and what happens to the address and its contents afterwards.
1. Plan the departure before changing the account
Agree the access cut-off time with whoever manages employment matters and the email service administrator. For a planned departure, arrange the project handover beforehand. If there is a security concern, restricting access may take priority, in line with your internal procedures.
Record where the address is used, not just where the employee reads email. An employee email account may also be a recovery address for other services or the identity used to sign in.
- Identify projects, clients and outstanding requests that need a new owner.
- Check applications, administrative accounts and services linked to the address.
- Assign each responsibility to a named person.
- Decide who can approve access to correspondence and for what purpose.
- Keep a record of changes that only authorised people can access.
The handover should cover work in progress and relevant documents, not the departing employee’s password. Keep important project information in shared business workspaces with individual permissions.
2. Remove access and end sessions where possible
Changing a password does not necessarily end every existing session. Some applications may continue working through tokens, app passwords or other authentication mechanisms. Available controls vary between services, so check the documentation and the administrator’s options.
- Block sign-in or suspend the account, if supported, or change the password according to your procedure. Check separately whether suspension also stops incoming messages.
- Revoke active sessions and authorised devices wherever this is supported, including connections used by email applications.
- Remove the former employee’s authentication methods: app passwords, passkeys, multifactor authentication devices and personal recovery details.
- Revoke connected application permissions and review delegated access, forwarding rules and filters that could send messages outside the business.
- Update access to associated services, including accounts that use this address for password recovery.
Do not remove every recovery method before confirming that the business retains administrative control. If shared passwords were used, change them and replace shared access with individual identities wherever possible.
Messages already downloaded to a device do not automatically disappear when server access is removed. Handle equipment returns and locally stored information through documented procedures. Do not remotely erase a personal device without clear grounds and an authorised process.
3. Transfer responsibilities, not the former employee’s identity
The person taking over should work through their own account. Do not give them the old password or encourage them to send messages as though they were the former employee. Recipients should understand who is replying and in what capacity.
If access to existing messages is necessary, prefer delegated access that is limited and auditable, where the service supports it. Select the conversations needed for the relevant projects rather than copying the entire mailbox into another employee’s account.
Move recurring work to role-based addresses
Addresses for functions such as billing or sales can reduce dependence on one individual. Depending on the service, these might be shared mailboxes, groups or aliases. The distinction matters: an alias does not necessarily have its own message history or access permissions.
If you are reviewing your infrastructure, check which email features are available with the web hosting service you are considering. Do not assume that every package supports delegation, activity logs or message retention after an account is suspended.
4. Decide what happens to new messages
You may keep the address receiving mail temporarily, set an automatic reply or, where appropriate and justified, forward selected messages. Choose an approach that meets business needs while respecting privacy requirements. Avoid leaving unrestricted forwarding in place indefinitely.
An automatic reply can be brief: “This address is no longer used for day-to-day correspondence. For enquiries about ongoing projects, please use the contact address below.” Add a real, verified address. Do not disclose the reasons for the departure or other personal details.
- Notify clients and partners involved in active projects directly.
- Update contact pages, forms, email signatures and application notifications.
- Assign someone to review incoming messages for a defined period.
- Test the address from an external account after making changes.
Avoid assigning a named email address to a different employee. This can cause confusion and expose messages intended for the person who left. At the end of the agreed period, review whether the address still needs to receive mail.
5. Set rules for retaining correspondence
A business mailbox may contain personal data, confidential client information and private messages. Owning or administering the address does not justify unrestricted access to everything inside it. Define the purpose of access, who is authorised and which categories of messages are needed.
For each category of business correspondence, set a retention period based on its purpose, applicable obligations and any relevant disputes. There is no single retention period suitable for every email. Seek legal or data protection advice where the circumstances require it.
- Keep only necessary messages and limit additional copies.
- Restrict exports and archives to authorised people.
- Log significant access and changes where the service supports this.
- Handle apparently private messages separately through an approved procedure.
- Schedule reviews and deletion of information that is no longer needed, taking legal obligations into account.
Explain these rules to employees before they leave, ideally through an internal policy introduced at the start of their employment. An archive retained for a specific purpose should not become a resource for unrestricted browsing.
6. Finish with a practical check
Do not treat the process as complete immediately after changing the password. Confirm that the former employee can no longer use the access methods you identified, that the designated colleague can handle incoming requests and that new messages are managed as agreed.
Use a final checklist: access removed, sessions revoked where possible, responsibilities transferred, automatic reply tested, archive access restricted and a review date recorded. For service capabilities, check the frequently asked questions or send an enquiry through the contact page. Do not include passwords or confidential messages in your initial request.
The practical goal: business communication continues through authorised people, without keeping the former employee’s access active or granting unnecessary access to their correspondence.
