After layoffs: what to do with departed employees' email and Slack

What should happen first to departed employees' accounts?#

The first step for departed employees' email and Slack is to stop anything that could delete them automatically. In many companies offboarding runs on autopilot: an identity provider deprovisions the user, a license clean-up script removes the mailbox, and retention policies quietly purge what is left.

After a layoff, that automation can erase years of customer threads, approvals and project discussions before anyone decides whether they matter. Ask IT to list every automated step that touches departed accounts in Google Workspace or Microsoft 365, Slack, the identity provider and backup tools, and pause the ones that delete.

Then check for legal holds. A reduction in force can lead to claims or disputes, and once litigation is reasonably anticipated, relevant records generally must be preserved. Counsel decides whether a hold applies and which accounts it covers. A short first-week list keeps the work in order:

• 1List every departed account with role, manager, departure date and the systems each person used.
• 2Pause license removal, deletion scripts and deprovisioning rules that delete data rather than block sign-in.
• 3Block sign-in and reset credentials, so preserved accounts cannot be used.
• 4Record counsel's hold decision and the accounts it covers.
• 5Note the shared drives, channels, mailboxes and repositories each person owned.

Preserve: a system-by-system triage#

Preservation options differ by system, and the right choice depends on your plan, your retention settings and the vendor's current documentation. The table lists common patterns to check, not exact product behavior, so confirm each one before acting.

Restrict: who may read a departed employee's account?#

A departed employee's account should be readable only by people with a defined business reason, and every access should be logged. Former managers often ask for full mailbox access to pick up customer threads; a narrower option is to delegate a specific folder or forward specific threads.

Work accounts hold personal content: medical appointments, family messages, benefits questions and sometimes complaints about the company. Browsing that content creates privacy and employment risk. Employment and privacy laws may apply; for example, the CCPA can cover California employees' personal information at businesses within its scope. Which laws apply is assessed with counsel.

• 1Name the roles allowed to open preserved accounts, such as IT security, HR and legal.
• 2Grant access per request with a stated purpose, not as standing permission.
• 3Prefer delegating a folder or a customer thread over opening the whole mailbox.
• 4Log every access and review the log whenever an account's status changes.
• 5Do not auto-forward a departed employee's mail to any personal address, including the former employee's own.

Record rights: what governs these records?#

Recording rights means writing down which policies, agreements and notices covered each departed employee's records, while the people who know are still employed. That note decides what the company may later do with the accounts, from internal review to licensing.

Shared Slack Connect channels and email threads with customers deserve their own entry. The messages your former employees exchanged with customers sit in your systems, but customer contracts may restrict how that content is used.

Keep, archive or delete?#

Keep, archive or delete decisions belong after preservation, access rules and rights notes are in place, and they should follow your retention schedule. The cost of a license on an idle account is a poor basis for a permanent decision.

A simple sort works for most companies. Accounts under legal hold stay exactly as they are. Accounts holding active customer, project or approval history are archived with restricted access. Accounts with nothing beyond what colleagues already hold are deleted on schedule, and the deletion is recorded.

Departing staff in estimating, engineering, customer support or account management often carry the most context. Their threads show how quotes were negotiated, why exceptions were granted and how problems were solved, which helps their successors and may later interest AI developers.

Illustrative: a manufacturer's customer service reduction#

Illustrative: a fictional industrial equipment manufacturer reduces its customer service and applications engineering teams. Its offboarding runbook removes Microsoft 365 licenses at month end, and its Slack workspace deletes messages after a set retention period.

The COO pauses the license removal. Counsel finds no general hold is needed but asks that accounts tied to an open warranty dispute be preserved unchanged. IT applies a retention hold to the departed engineers' mailboxes so they survive license removal, exports the applications engineering channels, and limits access to the quality manager and HR, with each request logged.

HR records the handbook version, confidentiality agreements and employee privacy notice in force for each person, and threads covered by customer NDAs are tagged. When leadership later asks whether its service and warranty history could be licensed, the preserved threads, access log and rights notes are already in order.

Where licensing fits, and how SourceX approaches it#

Licensing is a later and separate decision, and departed employees' records reach it only through preparation. Personal content is removed, names and contact details are replaced, and customer-restricted material is excluded. Automated tools help but are not complete: the documentation for Presidio, an open-source de-identification tool, warns there is no guarantee it will find all sensitive information and says additional protections should be used.

At SourceX, departed employees' records enter the SourceX five-step transaction (Supply, Rights, Preparation, Approval and Delivery) only after preservation and rights notes are complete. Nothing leaves the company during the initial assessment, which works from metadata, and each step needs the company's sign-off. A SourceX Evidence Packet then documents where the records came from, the licensing rights, permitted use, the privacy record and who authorized release. This is general information, not legal advice, so review your situation with counsel.