Technology offboarding: protecting information when employment ends

When an employment relationship ends, handing over credentials, final pay and employment certificates is not enough. Another increasingly important process must also take place: technology offboarding, a set of actions the employer carries out to ensure the departing employee no longer has access to the company's systems, data or confidential information.

This process is key to safeguarding the organization's digital assets and preventing legal, commercial and reputational risks.

What is technology offboarding?

It is a pre-established protocol under which a company revokes access, recovers devices (company-owned devices, or company information held under a BYOD arrangement, where employees use their own devices to perform their work) and secures the integrity and confidentiality of its information after an employment relationship ends.

The protocol should be triggered regardless of how the relationship ends: resignation, dismissal, expiry of a fixed-term contract or any other legal ground.

The employer's right to protect its information

Every organization has the right, and the duty, to protect its confidential information, even after the relationship with the employee has ended. This principle is supported by data protection rules and, in some countries, by provisions in both the Labor Code and the Criminal Code.

Two further principles are relevant:

1. Depending on the country, the duty of confidentiality may be perpetual.
2. The employer may adopt reasonable policies and preventive measures to protect sensitive information, ranging from contract clauses to the technical revocation of access and the traceability of documents handled by the employee.

What should effective technology offboarding include?

Not every country has a statute that sets out these steps, so every organization should have a protocol or policy designed around its own business needs. In practice, I have seen the following actions implemented:

1. An inventory of the access rights and assets assigned to the employee (equipment, accounts, credentials, software, etc.).
2. Immediate revocation of access to digital platforms, email, VPN and other tools.
3. Recovery or secure wiping of devices where equipment is used under a BYOD arrangement.
4. A signed and documented post-employment confidentiality clause, in accordance with Articles 2 and 7 of Costa Rica's Undisclosed Information Law (Ley de Información No Divulgada).
5. A letter reminding the employee of their confidentiality and post-employment obligations.
6. A forensic review, where the position involves a high level of access or potential risks.

Protecting information means protecting the business. In the digital age, every termination should be handled with security protocols that match the value of the data at stake.

Inquiries: aas@aguilar.law