25% of global data breaches are due to negligent employees. Globally, the average cost per lost or stolenrecord is $122 USD.
Source: 2017 Ponemon Cost of a Data Breach Study
When an employee leaves:
Human Resources professionals have the responsibility to not only provide a smooth transition, but also ensure confidential data is protected in the process. Be sure to cover all your bases especially during a job transition or departure. This means establishing information security best practices that address all sources of fraud or identity theft, including physical and digital data.
The Six Step Secure Employee Exit
1. Collect all records
Collect all documents or records created during employment that contain personal or identifying information. This includes any notes or documents from the employee’s supervisor regarding performance.
2. Stay organized
There are government and industry requirements for how long you need to keep certain records. Separate and store records based on required retention times or code them with colored folders. Ensure any documents that may be needed in the event of an audit are locked away but easily accessible.
3. Mark for destruction
Mark each record box with the employee’s departure date and the destruction date for their documents, based on legal requirements. This way you can see clearly when it’s time to destroy documents and avoid unnecessary stockpiling.
4. Protect customer data
Work with the departing employee to collect any contracts, accounting information or confidential customer data they have stored in paper files or on devices. Work with your IT team to remove any sensitive company or client information from personal devices used in a professional capacity, including smartphones, tablets and computers. Any information collected needs to be stored for the appropriate amount of time before destruction.
5. Destroy digital data
emove and destroy the hard drive from the employee’s computer before sending it for recycling. Destroying the device’s hard drive is the only way to ensure the employee and company information is unrecoverable. Don’t forget to also collect and destroy any company or corporate credit cards issued to the employee.
6. Understand legal requirements
In addition to your own organization’s rules on the collection and handling of confidential information, you have to follow legal requirements. Schedule a yearly meeting with your legal team to ensure you understand the requirements and any recent changes that affect document retention or the collection and handling of confidential information.
Employee Exit Checklist
What to Collect:
Résumés and initial job applications
Interview records and notes
Letters of reference and employment verification
Background checks and drug test results
Termination forms and letters
Medical or WSIB records
Performance appraisals and dispute records
Compensation records and job history
FMLA and USERRA records
I-9 and W4 forms
OSHA and COBRA logs
Where to Look:
Desktop and desk drawers
Filing cabinets, both shared and in the employee’s workspace
Removable media (USB sticks, CDs, removable hard drives, etc.)
The employee’s hard drive
Area(s) on server(s) designated for the employee’s use or under the employee’s control
Email and calendar accounts
The shared areas of servers
Electronic devices, whether owned by the company or individual
Timelines for Destruction
Background checks, drug test results, driving records, letters of reference
Compensation, job history, timekeeping records
FMLA and USERRA and related leave records
Annual Affirmative Action plans
Federal/state tax reports
4 Years after termination
3 Years after termination
2 Years after filing
2 Years after AAP year
5 Years after posting
6 Years after filing
4 Years after filing
This is a general guideline. Consult legal advice for your company's specific requirements.
Know your Legislation
The Privacy Act
HIPAA & HITECH
Payment Card Industry (PCI)
Fair and Accurate Credit Transaction Act (FACTA)
The Identity Theft Penalty
US Patriot Act
General Data Protection Regulation