What should we do if an employee leaves with business records saved on a personal device?

When an employee leaves and business records are sitting on a personal phone, laptop, or cloud account, the organization still owns those records. Personal custody does not change their status: if the content documents organizational activity, decisions, or transactions, it remains a record subject to your retention schedule, legal holds, and access obligations. The goal during offboarding is to recover that information, preserve it intact, and bring it under proper control before access is lost.

Act Quickly to Preserve

Departures are time-sensitive. Once an account is deactivated or a device is wiped, recovery may be impossible.

• Suspend any routine deletion and check whether a legal hold, audit, or open records request applies. If so, nothing may be destroyed.
• Identify where records likely live: personal email, messaging apps, file-sharing or cloud storage, and local device storage.
• Capture content in a way that preserves context and metadata (sender, recipient, dates) rather than copying text alone.

Recover and Transfer Records

Work with the departing employee, their manager, IT, and counsel to move records into official systems.

• Export business records into the organization’s approved repository and apply the correct classification and retention category.
• Verify completeness before the device or account is released, returned, or reset.
• Document what was recovered, by whom, and when, so the chain of custody is defensible.

Separate Personal from Business

Personal devices mix private and work content. Recover only the organization’s records, and respect the individual’s personal information. A clear scope, agreed in advance through policy, protects both parties.

Prevent the Next Occurrence

This situation usually signals a policy gap. Strengthen the program by:

• Setting a clear bring-your-own-device (BYOD) and acceptable-use policy stating that business records must not be created or stored solely on personal devices.
• Building records recovery into the standard offboarding checklist.
• Training staff that record status depends on content and function, not where a file happens to sit.

For deeper guidance on schedules, holds, and defensible disposition, see the retention and disposition hub. Sound recordkeeping principles call for records to remain authentic, complete, and accessible regardless of the device on which they were created.