Departing Employee Protocol: Protecting Company Data When Someone Leaves

Last updated: November 2026

When an employee with sensitive access leaves a California business, the employer should act in the first week. The departing employee checklist is short: cut off system access, preserve devices and accounts, review access logs for unusual downloads, conduct an exit interview, and collect a written certification that company data has been returned. Those steps protect a trade secret claim and, more often, prevent the need for one. Kolmogorov Law, P.C. advises employers on exit protocols and litigates departing employee disputes in Orange County, Los Angeles, and across California.

Call (909) 235-6116 or contact us online if an employee with sensitive access has given notice or already left.

Why the first week matters

Most trade secret cases involving departing employees are won or lost on evidence created in the days around the departure. A download of the customer database at 11 p.m. the night before notice, a USB device connected for the first time that week, a personal email account receiving forwarded attachments: those are the facts that support an injunction. Actual or threatened misappropriation may be enjoined. (Civ. Code, § 3426.2, subd. (a).)

The same week also decides whether the employer can show reasonable efforts to maintain secrecy, which is an element of the claim. (Civ. Code, § 3426.1, subd. (d)(2).) An employer that lets a departing salesperson keep a laptop for a month, or never revokes cloud credentials, hands the defense its best argument. Our page on reasonable measures to protect trade secrets covers the standing program.

California law also settles ownership. Everything an employee acquires by virtue of employment, other than compensation, belongs to the employer. (Lab. Code, § 2860.) The files are the company's, whatever device they sit on.

The departing employee checklist, step by step

On the day of notice. Decide whether the employee works out the notice period or leaves immediately. For roles with access to pricing, customer data, source code, or product plans, an immediate exit with pay through the notice date is often the safer course. Revoke credentials to email, cloud storage, CRM, code repositories, and shared drives at the moment of departure, not hours later.

Preserve before you investigate. Do not wipe and reissue the laptop. Have IT, or an outside forensic vendor for a senior or sales employee, make a forensic image of each company device and preserve the employee's email and cloud accounts.

Review the logs. Look at file access, downloads, external drive connections, cloud sync activity, printing, and email forwarding for the last 60 to 90 days.

Conduct the exit interview. Remind the employee of the confidentiality agreement and provide a copy. Ask where company information is stored outside company systems: personal phone, home computer, personal cloud, paper. Ask about the new employer and the role. Record the answers.

Collect the certification. Have the employee sign a short statement that all company property and information has been returned and that no copies remain, after a supervised deletion from personal accounts where needed. A refusal to sign is itself useful information.

Send the reminder letter. A one-page letter after departure restating the confidentiality obligations and, where appropriate, a short letter to the new employer stating that the employee has those obligations. Keep the second letter factual; an accusatory letter can create its own liability.

What not to do

Do not use the employee's credentials to access personal accounts, even if the employee used them for work. Unauthorized access to another person's account exposes the employer to claims under the same computer access statutes. Our page on Penal Code section 502 explains the civil remedy and its limits.

Do not threaten a criminal referral to gain an advantage in a dispute over commissions or a final paycheck. We pursue the civil remedies for data theft; prosecution threats as a bargaining tool tend to backfire.

Do not rely on a non-compete. A contract restraining an employee from engaging in a lawful profession, trade, or business is void to that extent, and an employer that attempts to enforce one commits a civil violation that exposes it to the employee's attorney fees. (Bus. & Prof. Code, §§ 16600, subd. (a), 16600.5, subds. (d), (e).) Our non-compete guide covers the 2024 changes.

Do not expect a court to stop the employee from taking the new job because of what the employee knows. California has rejected the inevitable disclosure doctrine; an employer must show actual or threatened misappropriation, not just that the employee's new role would make use of the old employer's secrets likely. (Whyte v. Schlage Lock Co. (2002) 101 Cal.App.4th 1443 [125 Cal.Rptr.2d 277, 292-294].)

When to escalate

Most departures end with the certification and the reminder letter. Escalation is warranted when the logs show copying, the employee refuses to certify, customers report being solicited with the company's pricing, or the new employer is a direct competitor and the role is the same. The first step is usually a demand letter that identifies what was taken and asks for a supervised return. If the response is inadequate, an application for a temporary restraining order can be heard within days. The forensic image and the access logs are the evidence that application rests on.

Before filing, the employer should be ready to identify the trade secrets with reasonable particularity, because discovery relating to them cannot begin until it does. (Code Civ. Proc., § 2019.210.) The exit protocol produces that list.

Three situations we see

A regional sales manager gives two weeks' notice and asks to keep the laptop to "wrap up accounts." The logs later show the full account history exported to a personal drive during those two weeks. An immediate exit would have prevented it.

A departing recruiter signs the certification, and the company sends a short letter to the new employer. The new employer responds that the recruiter has been instructed not to use any prior employer data, and the matter ends there. That is the usual outcome when the protocol is followed.

For the related problem of employees leaving in groups, see our page on employee poaching and raiding.

What to bring to the first meeting

Bring the employee's confidentiality and invention agreements, the resignation communication, a list of the systems the employee could access, any access logs already pulled, the names of the devices and accounts involved, and what is known about the new employer.

Frequently asked questions

What should an employer do when an employee leaves with company data?

Preserve the devices and accounts before anything is wiped, revoke access, review the logs, and send a demand for a supervised return with a certification. If the data is a trade secret and the employee refuses or the new employer is using it, a court may enjoin actual or threatened misappropriation. (Civ. Code, § 3426.2, subd. (a).) Our trade secret misappropriation guide explains the claim.

Can a departing employee keep files they created?

Generally no. Everything an employee acquires by virtue of employment, other than compensation, belongs to the employer. (Lab. Code, § 2860.) The employee's general skills and experience, and personal records such as pay stubs and the employment agreement, are the employee's.

Can I stop a former employee from working for a competitor?

Not on the basis of a non-compete, which is void in the employment context, and not on the theory that the new job will inevitably involve use of your secrets. You can enjoin actual or threatened misappropriation of specific trade secrets, which requires evidence of taking or threatened use.

Should I image the departing employee's laptop?

Yes, for any employee with access to sensitive information. A forensic image preserves the evidence of what was copied, deleted, or connected. Reissuing the device without an image usually means that evidence is gone.

Do I need an exit interview?

It is not legally required, but an offboarding interview serves two purposes. It reminds the employee of continuing obligations, which supports the reasonable efforts element, and it produces a record of where company information might be stored outside company systems.

Talk to a California trade secret attorney

If an employee with sensitive access is leaving, call (909) 235-6116 or contact us online before the devices are wiped. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and represents employers in Orange County, Los Angeles, and throughout California. See also our trade secret attorney page.

This page provides general information about California law and is not legal advice. Outcomes depend on the information, the evidence preserved, and the court.