This guide supports a smooth and secure transition when someone leaves ACG or no longer needs access. The aim is to remove access promptly while allowing approved work to be handed over appropriately.
- HR informs IT about staff departures as early as possible. For involuntary separations, IT should be notified on the same day so access can be removed without delay.
- Accounts are disabled on the final day of employment or enrolment rather than deleting them immediately. Earlier action may be needed when requested by HR or management.
- Disabled accounts are kept for an agreed transition period so that authorised work materials can be retrieved when needed.
- At the end of the transition period, accounts are deleted in line with the applicable retention requirements.
- Requests to access a mailbox or files during the transition period should follow the documented authorisation process.
Example Recommended offboarding timeline
- Day 0 (Last day): Disable the account, revoke MFA tokens, end active sessions, and collect any assigned device.
- Day 0 to 30: A manager may request access to specific files or messages through the formal authorisation process. Consult the DPO where personal data is involved.
- Day 30: Delete the mailbox. For a graduating student or retired staff member, switch the account to an alumni licence and remove benefits linked to the institutional email account, such as Microsoft Office access and cloud storage.
- Involuntary separation: Disable access as soon as HR provides notification and before the dismissal is communicated to the employee.