An employee has resigned. Should you be worried about your data?

Most people who resign leave on good terms and take nothing but their personal photos. But when someone leaves for a competitor or to start a similar business, the data they had access to can go with them. That means client lists, pricing, quotes, designs and templates.

In our experience it is rarely sophisticated. A USB drive. Files emailed to a personal address. A synced cloud folder. Photos of a screen.

Warning signs

None of these proves anything on its own, but together they’re worth a closer look:

• They’re joining a direct competitor, or starting a business in the same field.
• They asked for exports or reports they didn’t normally need in their last weeks.
• Clients start hearing from them, or moving, soon after they leave.
• Their laptop or phone came back wiped, reset or “lost”.
• Their account was used after their last day.

The mistakes that destroy evidence

The most common problem we see isn’t that the evidence never existed. It’s that it was destroyed after the employee left, usually with good intentions.

• Reimaging the laptop for the next starter. This is the most common one, and often the most damaging.
• Deleting the mailbox or cloud account to save a licence.
• A manager browsing their files and email to “see what’s there”. This changes dates and records and can weaken your position later.
• Confronting them before evidence is secured, which gives them time to cover their tracks.

What to do instead

1. Put the devices aside. Bag the laptop and any company phone and don’t let anyone use them.
2. Disable access, but keep the accounts. Block sign-in; don’t delete.
3. Speak to your lawyer if legal action is possible. Evidence gathered under their instruction may be protected by privilege.
4. Get a forensic examination before anything else happens to the devices.

What a forensic examination can show

Depending on the devices and systems, an examination can often establish:

• which files were opened, copied or downloaded, and when
• whether USB storage was connected, and what it was
• emails or attachments sent to personal accounts
• uploads to personal cloud storage
• what was deleted, and sometimes what it was

All of this is documented with a chain of custody, so it can support a letter of demand, an injunction or a court case if it comes to that.

If you’re worried about a departure, call Flare on 1300 027 401 before anything is wiped. More on our departing employee investigations.