What to Do When an Employee Leaves

By the BYOD Vs Company Notes editors / Oct 10, 2026 / 3 min read

Short answer. When an employee leaves, the organization should secure business accounts, preserve necessary company records, remove authorized access, and follow a documented process for returning company-owned devices. Handling employee leaves company phone data requires a clear distinction between information the business needs to retain and personal content that should remain private.

Key points

Prepare a device return and access removal process before an employee's final working day.
Preserve business records through authorized company systems rather than relying on a returned phone.
Personal information on a company-owned device still requires careful handling.
Document the device's condition, returned equipment, and outstanding business information.
Explain departure procedures to employees before their final day.

Start With a Departure Checklist

An employee departure involves more than collecting a phone. The organization needs to establish which business accounts must be closed, which records must remain available, and who will take responsibility for ongoing work. These decisions should be made before the employee's final day whenever possible.

The process should identify the employee's assigned equipment, business applications, access permissions, and any company information stored locally. A consistent checklist helps managers avoid overlooking shared accounts, active sessions, or documents that another employee needs to continue a project.

Identify all company-owned phones and accessories assigned to the employee.
List business accounts and applications requiring access changes.
Identify records that must be preserved for legitimate business purposes.
Assign responsibility for collecting and checking returned equipment.

Secure Business Accounts and Preserve Records

Business continuity depends on retaining organizational information independently of the departing employee's device. Important correspondence, project documents, customer records, and operational files should already be stored in authorized company systems. Where information exists only on a phone, the organization should identify the appropriate records owner and follow its established preservation process.

Access removal should be coordinated with the employee's final responsibilities. A manager may need continued access to a shared project or customer account, but that does not mean the departing employee's entire personal account history should be collected. Separate individual credentials, shared business resources, and organizational records before making changes.

Preserve required business correspondence and documents.
Transfer ownership of organizational files where appropriate.
Review shared business accounts and active access permissions.
Record which business information has been retained.

Handle Personal Information With Care

A company-owned phone may contain personal photographs, private messages, personal contacts, and other information created during ordinary use. Ownership of the hardware does not remove the need to consider privacy. Employers should distinguish company records from personal content and avoid treating a device return as permission to inspect everything stored on it.

The organization's written policy should explain how personal information is handled during a return, reassignment, or device reset. If a device contains both business and personal information, the responsible team should follow an established process that preserves required company records while respecting applicable privacy requirements. Unclear cases should be referred to the appropriate legal or privacy adviser.

Use Monitoring Records Only for Defined Purposes

Some employers use monitoring on company-owned phones to support a documented operational or security purpose. mSpy is a commercial app with an online dashboard and features listed on its official website that include location tracking, route history, supported messaging and social app monitoring, call logs, and website and app blocking. Availability depends on the operating system, version, plan, permissions, and setup.

If an organization has used mSpy on a company-owned device, any information available through its dashboard should be handled according to the original documented purpose and applicable retention rules. Monitoring does not guarantee a complete record of device activity or prove that every business file has been preserved. More intrusive capabilities, including keystroke logging, screen capture, live streaming, and call recording, require particular attention to proportionality, legal limits, and employee notice. Employers should never treat monitoring as a substitute for a proper records process.

Make Device Return and Reassignment Documented

The physical handover should be straightforward and recorded. The organization should confirm that the correct device has been returned, note its general condition, and identify any accessories or equipment that remain outstanding. If the phone will be reassigned, its preparation should follow the organization's approved device management and data-handling procedures.

Consent and transparency matter throughout this process. Employees should receive written notice explaining what happens to company-owned equipment, business records, and personal information when employment ends. Parents and legal guardians using mSpy to supervise their own minor children should likewise explain monitoring through an open, age-appropriate conversation. Employers must check local rules because legal requirements differ by country.

Record the device and accessories received.
Document any damage or missing equipment.
Confirm that business information has an appropriate organizational record.
Follow the approved process before reassignment or data removal.

Questions readers ask

Should an employer erase a company phone immediately after receiving it?

Not automatically. The organization should first determine whether required business records have been preserved and whether personal information needs to be handled under its established return procedure.

What happens if an employee leaves without returning the phone?

The employer should follow its documented equipment recovery and account access procedures. Any further action should be assessed under the employment agreement and applicable local rules.

Can a manager keep copies of everything on a returned company phone?

No blanket assumption should be made. Retention should be limited to information the organization has a legitimate reason and appropriate authority to preserve, with personal content treated separately.

What if the employee used a personal phone for company work?

The organization should follow its BYOD policy to address business account access, organizational records, and any company information stored on the device. Personal content should not be treated as company property merely because the phone was used for work.