When an employee leaves a law firm, the usual checklist is pretty straightforward:
Disable their email.
Collect their laptop.
Change a few passwords.
Maybe forward their phone.
Then everyone moves on.
But there is one question that often gets overlooked:
What happens to all the client data that employee had access to?
For a law firm, this is much more than an IT housekeeping issue. Client files can contain financial information, Social Security numbers, medical records, litigation strategy, intellectual property, confidential communications and other highly sensitive information.
And once that information leaves the firm’s controlled environment, getting it back can be difficult—or impossible.
Client Data Doesn’t Automatically Leave With the Employee
An employee may have had access to far more information than anyone realizes.
Depending on the firm’s technology environment, that could include:
- Microsoft 365 email and attachments
- OneDrive and SharePoint files
- Practice management software
- Document management systems
- Network file shares
- Cloud-based legal applications
- Client portals
- Case management systems
- Local files stored on a laptop
- Mobile devices
- Backup or synchronization services
The problem is that simply disabling a user’s Microsoft 365 account doesn’t necessarily answer the bigger question:
Where did that employee’s data go?
They may have downloaded files, synchronized folders to a personal device, copied documents to a USB drive, forwarded emails to a personal account, or retained access through another application.
That is why employee offboarding needs to be treated as a data-security process, not just an HR task.
What Happens When a Lawyer Leaves?
Departing attorneys create an additional layer of complexity.
The ABA has emphasized that both the departing lawyer and the firm have responsibilities to protect client information and files during a transition. Client files and property need to be handled according to the client’s direction, and confidential information must continue to be protected.
That means a law firm shouldn’t simply say, “Their account is disabled, so we’re done.”
The firm needs to determine:
Which clients are staying?
Which clients are leaving with the attorney?
Which files need to be transferred?
Who should continue to have access to those files?
And, perhaps most importantly:
Who should no longer have access?
The ABA’s 2026 Formal Opinion 520 also reinforces the importance of appropriately transferring information needed to protect a client’s interests when representation ends.
The Biggest Risk May Be the Employee’s Devices
Consider a typical scenario.
An attorney has worked at a firm for five years. During that time, they have accessed hundreds of client matters from their laptop.
They have:
- Downloaded documents
- Synced OneDrive
- Saved PDFs locally
- Sent emails containing client information
- Accessed cloud applications
- Connected their phone to firm email
Then they resign.
The firm disables the employee’s account.
But what about the copies of those files already stored on the laptop?
What about their phone?
What about locally cached Microsoft 365 data?
What about files synchronized to another device?
This is where a proper offboarding procedure becomes critical.
A Good Employee Offboarding Process Should Include More Than “Disable Account”
When an employee leaves, your IT provider should have a documented process for securing the firm’s information.
That process should generally include:
1. Disable accounts and remote access
Remove access to Microsoft 365, VPNs, remote desktop, cloud applications, file servers and other systems.
2. Revoke active sessions
Simply changing a password may not terminate every existing session. Active authentication tokens and sessions should be addressed as part of the offboarding process.
3. Secure company devices
Company laptops, phones, tablets and other equipment should be recovered and secured.
4. Review file access
Determine what sensitive client information the employee could access and whether unusual downloads, transfers or sharing occurred before departure.
5. Protect email
The firm’s email system should be configured appropriately so important client communications aren’t lost after the employee leaves.
For attorneys, this can be particularly important because communications may continue arriving at the former employee’s address after departure.
6. Review third-party applications
Don’t forget the applications outside Microsoft 365.
Practice management platforms, document management systems, accounting software, CRM systems and client portals may all have their own user accounts and permissions.
7. Handle departing attorney files carefully
If clients are moving with the attorney, the firm needs a documented process for transferring the appropriate files while continuing to protect confidential information.
Don’t Wait Until Friday at 4:59 PM
One of the biggest mistakes firms make is treating employee termination as an IT emergency.
The HR department sends an email:
“John is leaving today. Can you shut everything off?”
Now IT is scrambling to figure out what systems John had access to.
A better approach is to have a standardized employee offboarding checklist that HR, management and IT can follow every time someone leaves.
And for a law firm, that checklist should specifically address client confidentiality and data security.
Your Employees Will Leave. Your Data Shouldn’t.
Employee turnover is unavoidable.
Losing control of client data doesn’t have to be.
A properly designed offboarding process can reduce the risk of unauthorized access, accidental data exposure and former employees retaining access to sensitive information.
It can also give firm leadership something extremely valuable:
Confidence that when someone walks out the door, your client data stays where it belongs.
Is Your Law Firm’s Offboarding Process Secure?
Data Troop can review your firm’s employee offboarding process, Microsoft 365 security, access controls and client-data protections to identify potential gaps before they become a problem.
If you’re a Philadelphia-area law firm and you’re not sure what happens to your client data when an employee leaves, contact Data Troop for a review of your firm’s biggest cybersecurity gaps.