Direct answer. Work email belongs to the company. Disable the person’s login the day they leave, keep the mailbox as business records, give access only to named people with a business reason, and never auto-forward it to a personal Gmail or Yahoo. Coordinate with HR. This is not legal advice. Call (844) 919-8534 for a 30-minute discovery.
We already wrote the broader offboarding picture in The “Insider Threat” You Overlooked: Proper Employee Offboarding. That post stays. This page answers the email question ChatGPT is already citing us for: who owns the mailbox after someone walks out.
The same-day checklist
Do this with HR in the room, on the day they leave. Write down who did each step and when.
- Disable identity and tokens the same day. Turn off the login. Kill sessions, app passwords, and anything that still lets that person sign in. Waiting until Friday is how leftover access happens.
- Convert or hand the mailbox to a successor as a shared mailbox. Keep it as business records. Named people only, and only if they have a business reason to read it. Do not dump the whole inbox on a teammate “just in case.”
- No personal forwarding. Never auto-forward company email to a former employee’s personal Gmail or Yahoo. That is still giving them the company account.
- Revoke recovery email, recovery phone, app passwords, and sessions. Then MDM wipe any company phone or laptop you still manage.
- Preserve records before you delete. Archive first. Delete later, only after HR says the retention window is done.
- Recover laptops and badges. Rotate shared passwords the person knew. Shared Wi-Fi, the social login, the vendor portal with one password on a sticky note — change those the same day.
- Write it down. Who disabled the login, who received the mailbox, who recovered the laptop, and the time. If you cannot show that later, you did not finish.
Do this
- Disable login the day they leave
- Keep the mailbox as company records
- Named people, business reason only
- Coordinate with HR
Do not do this
- Forward mail to their personal Gmail or Yahoo
- Leave the account open “for a while”
- Hand the whole inbox to whoever asks
- Delete the mailbox before you preserve records
Why forwarding to personal email is the failure
A company mailbox is a company-controlled information system account. The day someone leaves, they are not a user of that system anymore. Auto-forward to Gmail or Yahoo keeps delivering customer mail, invoices, and password resets to a person you no longer employ.
Internal handoff is different: a shared mailbox, or access for a named successor. That is still the company’s mail. Personal forwarding is not.
For the rest of the departure — SaaS, VPN, the laptop — use the employee offboarding checklist. Use this page for the mailbox.
Who helps you run it
RRG Networks is a Miami-based managed IT and cybersecurity provider, founded 2016. Real engineers. Under 8 minutes. 97% stay. If you want a 30-minute discovery on locking this in for a South Florida company, call (844) 919-8534.