What should I do if an employee scanned records to a personal device or personal cloud account and then left the organization?

When an employee scans organizational records to a personal device or cloud account, those copies remain organizational records regardless of where they live. If that person has already left, treat the situation as both a recordkeeping gap and a potential security and privacy incident, and act promptly.

Confirm what happened and what is at stake

Start by establishing the facts. Identify which records were scanned, whether the originals or authoritative copies still exist in approved systems, and whether the content includes sensitive information such as personal data, protected health or financial information, or controlled material. Document your findings as you go, since this may later support legal, audit, or disclosure obligations.

Engage the right people early

This is rarely a records problem alone. Loop in legal counsel, information security, privacy, and human resources. If a litigation hold or investigation could apply, preserve everything and avoid deleting copies until counsel advises. Coordination prevents well-meaning cleanup from destroying evidence or violating retention requirements.

Recover and secure the records

Work through the former employee’s offboarding channels and any signed agreements to request return or verified deletion of the personal copies. Steps commonly include:

• Asking the individual, in writing, to return the files and delete remaining personal copies.
• Disabling or revoking any lingering access tied to their credentials.
• Verifying that authoritative copies exist in sanctioned repositories so the organization is not relying on the personal copy.
• Capturing dates, custodians, and actions to maintain a defensible chain of custody.

Close the gap and prevent recurrence

Once the records are secured, reconcile them against your retention schedule and file them properly. Then treat the event as a learning opportunity: confirm that staff have easy, compliant scanning tools, that policy prohibits personal-device capture, and that offboarding includes a records and data-return checkpoint. Sound digitization practices, including capture quality, metadata, and authorized storage, reduce the temptation to route records through personal accounts in the first place.

For broader guidance on scanning and managing digitized records, see the digitization and imaging topic hub.

The underlying principle is consistent across frameworks: records must remain reliable, authentic, and under organizational control throughout their lifecycle, no matter who created or stored them.