The Leaver's Data and Mailbox: Who Gets What, for How Long

Monday, 08:50, at Acme. Rosa runs a desk of three and the first ticket of the week is from Kay, the sales director. Kay writes the way sales directors write at ten to nine on a Monday: "Ben left on Friday. I need his mailbox, all his files, his contacts and his calendar, and can you forward everything that comes in to me permanently. Urgent, thanks." Ben was the account manager for the northern region, and Kay is not wrong that his mailbox holds the only record of four open deals. She is also asking for a dead colleague's entire working life to be poured into her own inbox, forever, by Tuesday. And she would be surprised to hear it put that way.

Rosa's job this morning is to give Kay what the business needs, within what the organisation's policy allows, with an end date. She must write down exactly what was given to whom. The leaver's data and mailbox is the part of offboarding that decides who may reach what a leaver left behind, in what form, and for how long. It then removes that access when the time is up. This article is part of our Employee Offboarding series. The last-day order that disables the account and leaves the mailbox intact is in The Offboarding Checklist: Disable First, Delete Later. This article is about the weeks after, when the mailbox is disabled, undeleted, and wanted.

It covers the two questions, who and for how long, then the manager who wants everything. Next come retention in plain words, the mailbox options side by side, converting the mailbox to a shared one, and the auto-reply. We cover the shared-drive handover, the personal items question, and the record in the ticket. A short war story follows, then the data handover record to copy, in that order.

The Two Questions: Who, and For How Long

Every request for a leaver's data comes down to two questions: who may have access, and until when. The desk's job is to make sure both are answered before anything is granted. The "who" is answered by policy, not by the desk. In most organisations the leaver's line manager may be given access to work mail and work files, on a written instruction from HR. Under those policies, nobody else may without a specific reason that HR has approved. The "until when" is answered by the hold period. That is the agreed stretch after the last day during which the account stays disabled and nothing is deleted. Access to the leaver's data lasts as long as the hold and no longer, unless somebody with the authority to extend it says so in writing.

A request that answers only the first question is incomplete, and most of them are. "Give Kay access to Ben's mailbox" is a request without an end, and access without an end becomes a permanent arrangement that nobody remembers approving. Rosa's first move, before touching anything, is to turn Kay's message into a request that answers both. It names the manager, delegated access to the mailbox, for the length of the hold, then review. The second move is to check that HR has written the instruction, or to ask them to. The desk acts on written authority when it comes to another person's mail. (HR will send it; HR has seen this before.)

Why does the desk care so much about the written instruction when the manager is standing there, reasonable and in a hurry? Because the mailbox is a person's correspondence, the person has gone, and the law in most places has views about who may read it and why. The desk is not qualified to hold those views and should not try. What it can do is insist, politely and every time, that the person who grants the access is the one with the authority to. It can insist that their name is on the ticket. Rosa's protection is the same as Kay's: neither of them decided this alone.

The Manager Who Wants Everything

The manager who asks for everything is not greedy; they are frightened of what they do not know is in there. And the desk's answer is to find out what they actually need and give them that, bounded. Ask the question the way an experienced technician asks it: "What are you worried about losing?" The answer is almost never "everything". It is the four open deals and the customer threads for the two biggest accounts. It is the meeting on Thursday that Ben set up and nobody else has the details of, and the spreadsheet he was working on. Each of those is a specific thing with a specific home, and each can be handed over without pouring a mailbox into another mailbox.

The bounded answer has three parts: what the manager gets, in what form, and when it ends. "You will have delegated access to Ben's mailbox from this afternoon, so you can read it and reply from it where you need to. You can move anything you want to keep into a folder of your own or into the team's shared mailbox. The access runs until the end of the hold, then I will ask you whether anything is still needed. For the files, I will transfer ownership of Ben's shared folders to you today. I will copy anything from his laptop you name once the laptop is here." That is a yes. It is a yes with the shape of the policy around it. Managers accept it far more readily than a flat refusal of the forwarding request, because their worry has been answered.

The request that must be refused, every time, is "forward everything that comes in to me permanently". A forward with no end date is the arrangement that outlives the manager and chains into the next leaver's mailbox. An audit discovers it years later with a customer's confidential message sitting in it. The war story below is that arrangement. The refusal is of the method, not the manager. And it comes with the alternative already attached, which is the shape of every good no described in Saying No Upward. Where the manager outranks the desk by some distance and insists, the decision goes to HR and whoever owns the data policy, in writing. The desk then does what they decide. A sales director has never once been made angrier by "I have sent that to HR with your deadline" than by "no".

Retention in Plain Words

Retention is the organisation's rule about how long each kind of information is kept before it is deleted. The leaver's mailbox and files are kept for as long as the rule says, whether or not anyone wants them. The rule is set by whoever owns the organisation's records policy, usually with legal advice. It varies by the kind of information. Financial correspondence may have to be kept for years, ordinary working mail for far less, and some personal data for no longer than its purpose lasts. The desk does not set these periods. It applies them. The first time a leaver's mailbox comes up, the desk asks the policy owner what the periods are. It writes the answer on the offboarding checklist so nobody has to ask twice.

Retention and access are different things, and keeping them separate solves most arguments. Keeping a mailbox for the period the policy requires does not mean anyone may read it for that period. Access ends with the hold. The mailbox then sits in an archive, disabled and unread, until retention expires and it is deleted. The manager's access is measured in weeks. The archive is measured in whatever the policy says. A legal hold is the exception that overrides both. When a legal matter is live or expected, the person responsible for it instructs that nothing belonging to the leaver is deleted until they say otherwise. The desk then marks the ticket and the archive accordingly and waits. Nothing the desk does to a leaver's data is ever faster than the policy, and nothing is ever slower than the legal hold.

In practice, at a fictional desk like Rosa's, the periods look like this. The hold, during which the manager has access, runs somewhere between one and three months depending on the role. The archive then keeps the mailbox for whatever the records policy says for that kind of correspondence. That might be a year for most roles and several for anyone who handled money or contracts. Deletion at the end of the archive period is a dated task with a sign-off, like the end of the hold. Those are one desk's numbers from one policy, not a standard, and the right ones come from your own policy owner. The point is that each period has an owner, a start, an end and a record. The mailbox never sits in a state nobody can name. The long version of what retention means for an ordinary user's mailbox, and the conversation about it, is in Mailbox Full and the Retention Conversation. The leaver's case is the same rules applied to someone who cannot be asked.

The Mailbox Options Side by Side

There are five things a desk can do with a leaver's mailbox during the hold. There is one it must never do, and the table below sets them beside each other. The "suits" column says which leavers need which; the last row is the one to say no to.

Two things in the table deserve a sentence each. Delegated access and the shared mailbox both keep the leaver's own sign-in disabled, which is why they are safe. Nobody signs in as Ben. Everything anyone does in the mailbox is done under their own name and visible as such. And every row except the last has an end date, because an arrangement without one is not an arrangement; it is a habit the organisation has not noticed yet.

Converting the Mailbox to a Shared One

Converting a leaver's mailbox to a shared mailbox turns it from a person's into a team's. The sign-in is gone, and named members open it from their own accounts. Mail sent to the old address lands where the team can see and answer it. In plain words, nobody is Ben any more, but the address still works and the correspondence is still there. It suits the role whose address customers will go on writing to for months. That could be the regional account manager, the recruiter, the buyer whose suppliers have the address on file. Many mail services can do this conversion directly; some need the mailbox exported and re-created. And the licence question, whether a shared mailbox needs one, differs by service; check yours and note the answer on the checklist. The mechanics of membership and sending as the shared address are in Shared Mailboxes and Delegation.

The conversion has three things to get right. The name: rename the display name to something that says what it now is ("Northern Region Accounts"). Leaving Ben's name on a mailbox three people read confuses customers and is unkind to Ben. The members are the manager and the people who inherit the work, listed in the ticket. They are reviewed at the end of the hold, and reviewed again whenever one of them leaves. The leaver audit article covers that. And the old content: decide, with the manager, whether the team inherits Ben's existing mail as well as the new. The alternative is to archive the existing mail so only new mail arrives in the shared mailbox. The second is cleaner and usually right, because a team that inherits a colleague's whole mailbox inherits a great deal it should never read.

The Auto-Reply

The auto-reply is set on the last day and says three things in two sentences. It says the person no longer works here, names who to contact instead, and says nothing else. It does not say why the person left, where they went, or when. It does not say "on leave" or "away from the office", which are untrue and lead to senders waiting. It uses the same wording for every leaver so that the wording itself reveals nothing. HR approves the words once and the desk reuses them. "Ben no longer works at Acme. For anything about your account, please contact northern@example.com or call the sales team on the main number." That is the whole message.

The auto-reply has a lifespan, and it is longer than the hold. During the hold it tells senders where to go while the manager reads what arrives. After the hold, when the mailbox is archived, the address may go on answering with the auto-reply for a stated period. Or it is attached to a team mailbox so that mail keeps arriving somewhere. Or it is allowed to bounce, which tells the sender in the bluntest way that the address is dead. Which of those is right depends on the role. A customer-facing address should go on answering or be redirected for as long as customers are likely to use it. That can be a year or more. An internal role's address can bounce after the hold. Decide it at the handover, write it on the record, and set a date for it. An auto-reply that runs for five years is a small monument to an exit nobody closed.

The Shared-Drive Handover

The leaver's files live in three places, and the handover treats each differently. Files in shared team folders are already the team's. The only task is to transfer ownership of anything the leaver owned, so that permissions and sharing do not break when the account is deleted. This is a change of owner, not a copy, and the manager is the usual new owner. Files in the leaver's personal cloud folder, the one that belongs to their account, are the ones the manager is worried about. The right move is to transfer ownership of that folder, or of the specific folders the manager names, to the manager for the hold. The transfer has the same end date as the mailbox. Files on the laptop's own disk are the reason the laptop sits on the quarantine shelf unwiped until the manager has confirmed what is needed. The equipment article explains that. The desk copies what is named onto the team's shared storage rather than giving anyone the laptop.

Resist the shortcut of sharing the leaver's entire personal folder with the whole team "so they can find what they need". The team then has access to everything the leaver ever saved, including the things they saved for themselves. And the organisation has created a permission that nobody will review and that the next audit will have to untangle. Give the manager ownership. Let the manager move what the team needs into the team's folders. And let the rest go to the archive with the mailbox. The permission tangle that results from the shortcut is a subject of its own, in Shared Folders and the Permission Tangle. And most of the tangles in it started with an exit.

One more place is worth asking about, because nobody else will: the leaver's own accounts outside the organisation that hold work. A personal cloud folder, a personal note-taking app, a messaging group on a personal phone. The desk cannot reach any of those and should not try. It can ask the manager, before the last day, whether the leaver kept work anywhere the organisation does not control. The desk can also ask the leaver, through the manager, to move it into the organisation's storage before they go. After the last day, that question becomes HR's, and the answer is usually "we don't know", which is why it is asked before.

The Personal Items Question

A leaver's mailbox and files contain personal things. The desk's rule is that it does not read them, does not delete them to be tidy, and does not hand them over to anyone on its own judgement. The mailbox contains personal e-mails, payslips, the photographs from the team day, a letter from the leaver's doctor that came to the work address. All of these are in the mailbox the manager is about to be given access to. The manager should be told that, and told what the organisation's policy says about it. Most policies say that work systems are for work and that the organisation may access them for business reasons. And most policies also say that it will do so proportionately. That is a word that means the manager reads what they need and leaves the rest alone.

The leaver's own request for their personal items is handled by HR, and the desk's part is the copy. Where HR agrees that the leaver may have their personal files, the desk copies the named items, supervised, onto a medium HR provides. It records that it did so. Where HR declines, the desk says nothing to the leaver beyond "please ask HR". The desk never gives a leaver access to their disabled account to "get their stuff", because an enabled account is an enabled account whatever the reason. In most places, privacy law gives the leaver rights over their personal data. Where the organisation operates in such a place, HR and whoever handles legal matters know what those rights are. The desk's job there is to do what they decide, promptly, and write it down.

The Record in the Ticket

Everything granted under this article goes in the leaver's ticket as a line with four parts: who, what, from when, until when. "Kay, delegated access to Ben's mailbox, from today, until the end of the hold on the date in the parent ticket; HR instruction attached." "Kay, ownership of Ben's personal folder, same dates." "Northern team mailbox: members Kay, Dev and Sunita, reviewed at the end of the hold." The removal of each is a dated task under the parent, owned by the desk. And it is not optional. Access that was granted with an end date and never removed is the same as access granted forever. There is the added embarrassment of a record that shows the desk knew.

The ticket also carries the conversation, which matters because the conversation changes. Kay will reply on Wednesday saying she also needs Ben's calendar, and on Friday saying Dev should have the mailbox instead. In a tool where the requester's reply reopens the ticket, those changes land on the same record as the original request, in order, with times. That happens in QuerySolv and many others. The desk then adjusts the grants and the dates in one place.

Finally, write the policy down somewhere the managers can read it before they ask. A short knowledge base article, visible to everyone, says what a manager may request when someone leaves. It says what form the handover takes, how long it lasts and what the desk will refuse. That turns Kay's Monday message into a request that already answers both questions. If you run QuerySolv, a knowledge base article visible to everyone is the natural place for it. In any tool, the point is that the rules are public before the exit. That way, the desk is applying a policy rather than inventing one at ten to nine.

A Short War Story: The Tender in Three Mailboxes at Greyfriars Architects

Greyfriars Architects lost an associate called Malcolm to a practice across town. A partner called Alistair had worked with him on every bid for a decade. Alistair told the desk to forward all of Malcolm's incoming mail to his own mailbox "so nothing gets missed". The desk did, with no end date, because Alistair was a partner and the desk was one person. Two years later Alistair retired. The desk, by then a different person, set his mail to forward to the managing partner's assistant in the same way. So Malcolm's old address now delivered to a mailbox two steps removed from anyone who had known him. A client, preparing a confidential tender, wrote to the address they had on file for Malcolm with the full bid documents attached. The documents were delivered to the assistant, who did not know who Malcolm was. The assistant filed them under "unknown", and mentioned them a fortnight later at a meeting with a competing client. The practice discovered the chain only when the first client asked why their tender had been discussed elsewhere. The cost was a lost client, a formal complaint, and roughly twenty hours of desk time unpicking every forwarding rule in the firm. There turned out to be nine, all of them from exits. Greyfriars wrote the lesson into its process. Access to a leaver's mail is granted to a named person for a stated period and removed on the date. Forwarding is never the method. And "so nothing gets missed" is a reason to set an auto-reply, not to open a pipe.

The Data Handover Record

The record below is one page per leaver, kept with the parent ticket. And it is filled in by the desk as the handover is agreed and updated as it changes. The top block is the authority: who asked, who approved, and the dates that bound everything below. The middle blocks are the mailbox, the files and the personal items, each with who, what, from, until. The last block is the removal. And it is the block that most desks leave blank, which is why it has its own dates and its own signatures. Nothing on the record is a secret and nothing on it is the content of anything handed over. It is the account of who could reach what, and when they stopped.

DATA HANDOVER RECORD — ONE PER LEAVER
Leaver: ______________________   Role: ______________   Parent ticket: ________
Last working day: __________   Hold ends: __________   Legal hold: none / yes, owner: ______________
Requested by: ______________   HR written instruction from: ______________ on __________
Retention period for this role's mail and files (from policy): ______________

A. THE MAILBOX
   Handling during the hold (tick one):
     [ ] Auto-reply only        [ ] Delegated access to ______________
     [ ] Converted to shared mailbox named ______________________; members: ______________
     [ ] Internal forward to ______________ from __________ until __________ (short, dated)
   Auto-reply wording: HR standard, contact named: ______________
   Auto-reply or redirect continues after the hold until: __________ / address bounces from: __________
   Forwarding rules found on the last day: ______________________ removed by ________
   Access granted to: ______________  from __________  until __________  granted by ________

B. THE FILES
   Shared folders owned by the leaver, ownership transferred to ______________ on __________
   Personal cloud folder: ownership transferred to ______________ until __________
   Laptop: on quarantine shelf ______; items named by the manager copied to ______________ on __________
   Manager confirmed nothing further needed from the laptop on __________  (then wipe)
   Work held outside the organisation's systems: asked on __________; answer: ______________

C. PERSONAL ITEMS
   Manager told that personal items exist and that access is proportionate: __________
   Leaver's request for personal items: none / received on __________; HR decision: ______________
   Items copied under supervision to a medium HR provided on __________ by ________

D. CHANGES DURING THE HOLD (each as a dated line on the ticket)
   __________  ______________________________________________
   __________  ______________________________________________

E. THE REMOVAL (the block that is usually left blank; do not leave it blank)
   Manager asked whether anything is still needed on __________; reply: ______________
   Delegated access removed on __________ by ________
   Internal forward removed on __________ by ________
   Shared mailbox members reviewed on __________; leaver's name removed from display: Y / N
   Folder ownership finalised to ______________ on __________
   Mailbox archived on __________; deletion due per retention on __________ (dated task set)
   Files archived on __________; deletion due per retention on __________ (dated task set)

Rosa gave Kay delegated access to Ben's mailbox by lunchtime, with HR's note attached. She gave Kay ownership of his folders by the end of the day, and put a date on both. Kay replied on Wednesday asking for the calendar, which reopened the ticket and took four minutes. On Friday she asked whether the northern address could become a team mailbox. It did, under a new name, with three members and a review date. The four open deals closed, two of them well. Nobody has forwarded anything anywhere. The knowledge base article Rosa wrote that afternoon has been read, by her count, by every manager who has since lost someone, before they asked.

Frequently Asked Questions