Former employees in archived records: notice, deletion and access requests

Do former employees keep privacy rights in company archives?#

Former employees keep privacy rights in company archives, and the scope of those rights depends mainly on where they live and which laws apply to your company. California is the clearest case: the CCPA's temporary exemptions for employee and business contact data expired on January 1, 2023, so covered businesses now owe California employees and applicants the same rights as other consumers.

Under the CPRA amendments, an employee can request the specific pieces of personal information an employer holds about them that were generated on or after January 1, 2022. Leaving the company does not end that right, and access requests from former employees sometimes arrive around a dispute, which is a reason to handle them carefully and on the record.

Outside California the picture is less uniform. A 2022 law firm alert noted that the other comprehensive state privacy laws then enacted did not apply to employment-context data, but more states have passed laws since, so counsel should check each statute's definition of consumer. The California Privacy Protection Agency also opened preliminary rulemaking in April 2026 on how the CCPA applies to employee, applicant and contractor data.

Step one: find every departed person in the records#

Finding every departed person in the records starts with HR data and ends with each system's own user list, because people leave traces under different names in different tools. One consultant can appear as a full name in email, a handle in Slack, a display name in Jira and initials in a CRM field.

Retained mailboxes deserve attention. Microsoft stores Teams chat data in a hidden folder in the mailbox of each user included in the chat, searched through eDiscovery rather than opened directly, so a departed person's messages can persist in colleagues' mailboxes, and in any mailbox kept under a retention policy, long after their own account is gone.

• 1Pull the termination list from the HRIS, including contractors and interns where tracked.
• 2Export deactivated users from Google Workspace or Microsoft 365, Slack, Jira, Confluence, GitHub and the CRM.
• 3Check for inactive mailboxes and shared mailboxes converted from departed users.
• 4Collect name variants, nicknames, personal email addresses and phone numbers that appear in their records.
• 5Note departure circumstances only where they affect scope: dispute, hold, separation agreement or open request.

Step two: check requests, holds and agreements#

Checking requests, holds and agreements tells you which departed people's records can be prepared, which need special handling and which must stay out. Do it before preparation starts and again right before release, because new requests can arrive mid-project.

Legal holds can make archives larger than expected. Slack states that when a legal hold is in place, messages and files sent by all members in a conversation are saved regardless of retention settings, even if members edit or delete content. Treat preserved content as reserved for the legal matter, not as licensing inventory.

Step three: pseudonymize consistently across systems#

Consistent pseudonymization gives each departed person one stable code across email, chat, tickets and code reviews, so the workflow stays readable while the person disappears from it. Inconsistent codes break threads, and partial coverage leaks identity when one system keeps a real name.

Use a single roster key that maps every name variant, handle, address and phone number to the same pseudonym, and keep that key inside the preparation environment. Generalize role and tenure details that would single someone out, such as the founding engineer or the first hire at a new office.

Personal content needs separate treatment. Former employees often used work accounts for medical appointments, family logistics, job searches and farewell messages. Exclude those messages rather than pseudonymizing them, because the content itself can identify the person.

Is notice to former employees required before licensing?#

Whether notice to former employees is required before licensing depends on the laws that apply, what your privacy notices said at collection, and whether the licensed data is still personal information. Counsel weighs these together; no single answer fits every company.

De-identification is often the practical path. Under the CCPA, information counts as deidentified only if it cannot reasonably be linked to a particular consumer and the business takes reasonable measures against re-association, publicly commits to keep it deidentified, and contractually obligates recipients to comply. Data that meets that definition generally falls outside the law's personal information rules, which is why companies prepare the licensed dataset, not the source archive, to that standard.

Some companies also update their public employee privacy notice to describe licensing of de-identified records, even when counsel concludes individual notice is not required. That choice is part of the trust decision as much as the legal one.

Illustrative: a consulting firm with many departures#

Illustrative: a fictional management consulting firm wants to license proposal development, project reviews and internal knowledge threads from Google Workspace, Slack and Salesforce. Turnover is normal in consulting, so many of the people in its records have left.

The roster work found departed staff under several handles each, a group of mailboxes kept for a past investigation, and a former partner whose records sat under a litigation hold. The partner's mailbox, chats and related threads were excluded in full, as were all exit and severance conversations.

Midway through preparation, a former analyst sent an access request. Counsel's team answered it from the source systems, logged it, and confirmed it did not change the licensed scope. The remaining departed staff were pseudonymized with one roster key across every system, and the firm updated its public privacy notice before release.

How SourceX approaches departed staff#

SourceX handles former employees inside the Rights and Preparation steps of the SourceX five-step transaction. The roster approach, the exclusions for holds, disputes and requests, and the pseudonymization method are recorded in the privacy record of the SourceX Evidence Packet.

The supplier keeps the roster key and approves the final scope. A last check for new requests is part of release authorization, the final item in the Evidence Packet before Delivery.