Employee Offboarding in a CRM: Removing Access, Keeping Data
Employee offboarding in a CRM comes down to four moves: deactivate the person’s login on their last day, hand everything they owned to someone else, check every connected tool, and keep their records, because that history belongs to the company. Run a small business? Just realised a former employee might still be able to sign in? Yeah, that one stings. This employee offboarding CRM checklist shows you where to start and what to check.
Table of Contents
Employee offboarding CRM checklist: what to do on the last day
On the last day, lock the account, give the person’s work to new owners and close every side door, in that order. Same sequence every time. That’s the whole trick, because when the week is busy you won’t remember what you skipped:
- Deactivate the user account so the login stops working.
- Reassign leads, deals, tasks and tickets to active colleagues.
- Check integrations and shared logins the person used.
- Review and limit export rights.
- Free the seat on the billing page.
- Write down what was done and when.
Do it on the last working day. Not a week later, when nobody can say who still has access (and everyone assumes someone else handled it).
How do you revoke CRM access without losing data?
Deactivate the user account instead of deleting it, so contacts, notes, deals and relationship history stay exactly where they are. A deactivated user can’t sign in anymore. But their name stays on every record they created or updated, so the timeline still reads properly. Deleting is a different story. It removes the user entirely, which can leave records with no owner or cut the link between a client and their history. Change the person’s role before deactivation or right after it, in your user roles and access rights settings, so nothing reopens by accident.
And the CRM login is rarely the only credential someone knew. Think about it. The shared inbox, the help desk mailbox, the accounts behind your website forms: change those passwords too, since any of them can lead back to the same data.
Who owns the departing employee’s records now?
Every lead, deal, task, ticket and project assigned to the departing person needs a new owner on or before the day their access ends. Go through these one by one, no shortcuts:
- open deals in the pipeline
- leads assigned to the rep
- tasks and Kanban cards where they are the assignee
- reminders set for them
- help desk tickets they own
- @mentions still waiting for their reply
Why bother? Reminders and tickets without an active owner just sit there, unanswered. Team reports get skewed too, when an inactive name is still holding live work. Talking to clients and passing relationships on is its own job, covered in our guide to reassigning a departing rep’s clients.
Which connected tools can a former employee still reach?
A CRM login is only one way in, so personal connections to Slack, Google Calendar, Trello, Mailcraft and Fakturownia need checking one at a time. For each integration, ask one question: whose account was used to set it up? If the answer is the person who just left, reconnect it through a company account. Otherwise data keeps flowing through someone who doesn’t work for you anymore.
API keys and scripts they created? Rotate or remove them. In EpicCRM, the API, Trello and Google Calendar integrations come with the Business plan, so teams on that plan should pay the most attention here. Then hunt for the quieter leftovers: calendar invites and Slack notifications still pushing CRM updates to a personal channel. Point them at a shared one.
Exports and copies: controlling departing employee data access
Limit who can export data before the notice period starts, because once an export has been taken, you cannot take it back. Simple as that. My advice: export rights for owners and admins only, and everyone else works inside the CRM, where access follows the account. When the company laptop or phone comes back, sign out of every browser, delete downloaded CSV and XLSX files and check email for copies of customer lists.
This isn’t just housekeeping, though. Under the General Data Protection Regulation, personal data should be processed in a way that ensures appropriate security and confidentiality, including preventing unauthorised access to the data or its use. If you want to see our side of it, here’s how customer data is protected on the platform.
Freeing the seat and closing the offboarding
Once access is removed and records are reassigned, remove the seat on the billing page so you stop paying for it. Then write a short record. Nothing fancy:
- the date of deactivation
- who took over which records
- which integrations were reconnected
- which passwords were changed
Keep that record and turn it into a reusable offboarding checklist. Next departure, it takes minutes instead of guesswork. For anything you might have missed, a broader security checklist for cloud CRM fills the gaps.
Small teams feel these gaps hardest, since one person often holds several logins. That’s why we built our CRM for small companies around clear roles.
So what does a well-run employee offboarding CRM process leave behind? Three things: access is gone, the data is intact and every open item has an owner.
FAQ
Should I delete a former employee’s CRM account?
No. Deactivate it. Deleting the account can break ownership and history on the records they worked on, while a deactivated account blocks the login and keeps the full history of each record.
How quickly should I revoke CRM access after someone leaves?
On their last working day, ideally right when they finish work. If someone leaves suddenly, cut access right away and sort out their work afterwards. Waiting only leaves the door open longer.
Do I still pay for a deactivated user?
Deactivating a user and removing their seat are two separate steps, and the seat comes off on the billing page. Remove it once the person’s records have new owners. Until then, the seat may still count towards your subscription.
