When someone leaves, close every door and keep what you must.

A departure is when access is most likely to be left open. The mailbox still receives client correspondence, the practice management login still works, the laptop in the drawer still holds copies of client ID. None of that is anyone's fault; it is simply nobody's job. We make it a short, documented piece of work with an end.

Written authorisation comes first

We do not open a mailbox, a file store or a device without written authorisation from the business. It has to come from someone with authority to give it, and it sets out exactly what we may review and why. The review stays inside that scope. If something falls outside it, we stop and ask rather than look.

A departing person's mailbox and devices usually hold some of their own personal information too. We handle it as little as the work allows, and we do not copy it anywhere.

Required records are retained, never destroyed

Destroying what you no longer need is good practice. Destroying what you are required to keep is a problem. Records the law requires you to hold — for an AML/CTF reporting entity that includes customer identification and transaction records, alongside tax, employment and client records — are identified with you before step four and preserved, not wiped.

Copies of client ID are the usual example. Copies made before 31 March 2026 are AML/CTF records that must be kept for 7 years after the business relationship ends, while copies of full ID documents made after the new laws commence should not be kept for AML/CTF record-keeping at all. A departing staff member's inbox is often where both kinds turn up. Source: OAIC, privacy guidance for reporting entities under the AML/CTF Act.

Where how long a record must be kept is a legal question, your own adviser or professional body decides it. We are not lawyers and we will not guess.

What you receive

• A record of every account disabled, with the date and time.
• A list of the records retained and where they now live.
• The handover: files and correspondence the business needs, delivered to the person you nominate.
• A certificate of destruction for every device, listing make, model, serial number and the method used. See data destruction for the method by media type.

Our certificates are a record of work we performed and can evidence. They are not a certification issued under an accreditation scheme, and oowl holds no such accreditation.

Price

Quoted per departure and fixed before we start, because one person with a laptop and a phone is not the same job as a partner leaving with fifteen years of correspondence.