Employee Offboarding: Remove Access, Update Contact Data and Preserve Records

When an employee leaves, the organisation should promptly remove or update public-facing contact details and revoke access that is no longer needed. It should not treat that operational clean-up as a command to erase every employment record. Payroll, tax, benefits, security, litigation and regulatory records may have distinct purposes and retention rules. The departing employee can request correction or removal of particular information, but whether a legal right is currently enforceable depends on the applicable law and its effective date.

As of 24 October 2026, India’s Digital Personal Data Protection framework is on a staged commencement timetable. The Central Government’s 13 November 2025 commencement notification brought specified institutional and enabling provisions into force then; it schedules the principal processing obligations in sections 3–17 and associated provisions for eighteen months after publication, i.e. 13 May 2027. Separate provisions have different dates. The DPDP Act, 2023 and DPDP Rules, 2025 should therefore be read alongside their commencement instruments; do not present the full future framework as already operative in October 2026.

This timing does not mean employers can ignore privacy or security. Other applicable requirements, contracts, sector rules and existing law still matter. The Information Technology Act, 2000 and 2011 sensitive-personal-data rules remain part of the current official framework to the extent in force and applicable; the DPDP Act’s section 44(2) amendment omitting IT Act section 43A is itself tied to staged commencement. Check changes before relying on any old compliance checklist.

Separate the offboarding outcomes

One employee record can be copied across dozens of systems. Build separate task tracks so a request to remove a phone number does not inadvertently destroy a payroll record or leave customer-facing contact details active.

“Delete all my data” may describe a genuine concern, but operationally it needs scoping. An employer should explain the categories it can remove, deactivate, correct, restrict or retain, and the reason. If a public profile wrongly suggests the person still works there, that can often be corrected without erasing historical records.

What can a former employee request?

Start with a precise written request: identify the record or channel, explain the inaccuracy or concern, state the requested outcome, and provide enough information to locate it. Examples include removal of a personal number from a public page, correction of a misspelled name, restriction of an obsolete emergency contact, or confirmation that account access has been disabled.

Avoid promising that every request is a presently enforceable statutory erasure right under the DPDP Act in October 2026. Its core duties and rights have staged effective dates. Section 12 of the Act describes erasure in defined circumstances, subject to continuing legal obligations, but the commencement notification places sections 3–17 on the eighteen-month date. The official text and notification should be checked again when acting after the scheduled date or if a later notification changes it.

The current position can also depend on the type of data and existing law. The IT Act’s section 43A and the 2011 Rules address specified sensitive personal data and security practices in their applicable scope; they do not create a general right to delete every employment record. In addition, a company may have to keep particular records under labour, tax, company, sector-specific or litigation requirements. A former employee can still ask the organisation to identify the basis and retention period, but should not assume that asking automatically compels deletion.

A practical request and response workflow

For the former employee

1. List specific instances. Give the URL or system, screenshot or date observed, data field, and preferred action. Separate public contact details from internal historical records.
2. Explain the problem. Say, for example, “This page lists my private mobile as the current sales contact although I left on [date]. Please remove it or replace it with the team contact.”
3. Ask for correction and status. Request confirmation that the public display is updated, account access is revoked, and any remaining internal record is retained for a stated reason or period where the organisation can disclose it.
4. Use the designated channel. Send it to HR, the privacy contact or grievance contact listed by the organisation. Do not send identity documents through an unverified address.
5. Keep evidence. Save the request, delivery confirmation, reply, and the public page before and after any change.
6. Escalate proportionately. If ignored, send one follow-up with the original request and a reasonable deadline. Tailored legal advice should identify which law and remedy are effective for the data and date in question.

For HR, IT and privacy teams

1. Verify identity without collecting excess data. Use an existing HR channel or a proportionate verification step. Do not request a full identity packet for a routine website update if a known work email and employee ID will do.
2. Classify the requested object. Distinguish current public details, login credentials, business correspondence, employment record and personal contact field.
3. Route to owners. HR owns employment facts; IT owns access and credentials; communications owns public pages; legal/privacy reviews retention, disputes and rights.
4. Act on urgent exposure. Revoke credentials and remove a former employee from public contact points on the exit schedule. Rotate shared secrets when necessary. Preserve evidence where there is an incident or hold.
5. Assess retention individually. Record purpose, legal or contractual basis, record owner, retention trigger, access restrictions and review date. Do not retain indefinitely just because storage is cheap.
6. Respond in plain language. State what was changed, what was not, why it remains, who can review the decision and when the next retention review occurs.
7. Close with proof. Save task completion, system confirmation and the response, without copying unnecessary sensitive data into a ticket.

The official SPDI Rules, 2011 and the government’s 24 August 2011 clarification on their scope are useful when determining whether the data and organisation fit that older regime. They are not a substitute for a current applicability analysis or the staged DPDP commencement rules.

Worked example: remove the number, retain the payroll file

Rohan leaves a mid-sized consulting firm. Three weeks later, a customer calls his personal mobile number because an old proposal PDF and the website still show him as the account manager. He also asks the company to delete all his employment data.

The firm can treat these as distinct actions. Communications removes the old page and replaces the proposal contact for future use, while customer success tells existing accounts the new contact. IT confirms his login and tokens are disabled. HR acknowledges the broader request and identifies categories that may be retained for payroll, tax, benefits and a current contractual dispute, with restricted access and a review point. The firm does not promise that every backup disappears immediately; it explains the actual system lifecycle and avoids restoring obsolete contact details from archived copies. Rohan keeps the dated request and checks the public page again.

This example is not a ruling that any particular record must be retained. The employer should confirm the relevant obligation and period with counsel, then document its decision. If the number is being used after the correction request, that may raise a different factual and legal issue from archival payroll retention.

Retention should be purposeful and bounded

Create an offboarding record map rather than a single “retain/delete” checkbox. For each category, record: purpose, source system, owner, access after exit, retention trigger, applicable legal basis, deletion or review action, and any legal hold. Examples include payroll records with tax duties, access logs for security, performance records relevant to a live dispute, and public profile fields whose purpose ends at separation.

The current Code on Wages, 2019, applicable state employment laws and other statutes may require records or constrain wage handling. They do not all set one universal retention period for every personal field. Confirm the precise recordkeeping rule and coverage. A litigation hold or regulatory direction can pause normal disposal for a defined scope, but it should not silently permit unrestricted reuse.

Review systems beyond the HRIS: collaboration accounts, helpdesk, marketing lists, CRM, access-control panels, public directories, shared mailboxes, third-party processors, mobile-device management, analytics, backups and exported spreadsheets. The privacy workflow should identify owners and completion evidence for each, not assume that disabling a login updates every downstream copy.

Decision table: remove, correct, restrict or retain?

Checklist for a defensible offboarding process

• Confirm separation date and responsible HR, IT, communications and legal owners.
• Disable credentials, sessions, keys, badges and third-party accounts on the approved timeline.
• Remove the former employee from public-facing contact channels and update customer ownership.
• Transfer business records without transferring personal accounts or credentials.
• Identify personal contact fields separately from employment and payroll records.
• Record each retention purpose, source, owner, trigger, access rule and review date.
• Apply a scoped legal hold when required and document release.
• Check vendors, exports, replicas, archives and backup behaviour.
• Respond to employee requests with a factual outcome and current legal basis.
• Recheck the DPDP commencement schedule and any later official notification before describing statutory rights.

Frequently asked questions

Can a former employee force a company to delete every record?

Not safely as a blanket proposition. The requested data, purpose, applicable law, legal obligations and commencement date matter. Section 12 of the DPDP Act describes erasure subject to continuing legal obligations, but its scheduled commencement is later than 24 October 2026 under the 2025 notification unless changed by a later official instrument.

Must a company remove a former employee’s phone number from its website?

If the number is no longer a valid current contact, a prompt correction or removal is a sound operational step. Whether a legal duty arises depends on facts and applicable law. Preserve a dated record of the update and check linked pages or documents that continue to circulate.

Can HR keep payroll and tax records after resignation?

Some records may need to be preserved for legal, tax, accounting, benefits or dispute purposes. The organisation should identify the applicable requirement and period, limit access, and avoid keeping unrelated personal data indefinitely. There is no single universal answer for every employment record.

Does revoking the employee’s email account delete their data?

No. Access deactivation is a security control, not deletion. Business records, backups, shared mailbox content and copies in other systems may remain under controlled retention and preservation rules.

Does DPDP apply to an employee’s data?

The Act’s definitions and provisions should be assessed for the particular processing; do not assume employment data is categorically excluded. As of 24 October 2026, the main processing obligations are on the staged commencement schedule. Check the official commencement notification and any later changes.

What if a former employee’s data is causing calls or messages after exit?

Document where the data appears and route correction to the relevant owner. Remove obsolete public contact details, correct CRM ownership, tell customers the current contact and check vendor pages or exported material. Keep evidence of the correction and investigate any unauthorised use separately.

Put the workflow in one place

An offboarding process works when HR, IT, communications and legal can see ownership, dates, retention decisions and proof of completion. Gotham’s DPDP retention and deletion schedule, data-principal request workflow and grievance workflow offer related operational models. For a workflow discussion, contact Gotham.

This educational guide is not legal advice. Employee-data rights and retention duties depend on the data, purpose, applicable law, sector, contract, commencement dates and facts; obtain tailored advice.
How Gotham researches and reviews field guides