When Staff Leave, Protect Your CRM: An Access and Lead Handoff Checklist

When a salesperson, office manager or contractor leaves, your CRM holds two risks at once. Their login may still work, and the leads they owned may sit untouched. Close the access on their last day and reassign every open lead within one business day.

This post gives you a short checklist for both jobs. It needs no special software, only a written routine and one person who runs it.

Why Offboarding Belongs in Your CRM Plan

Your customer list is a business asset. It holds names, phone numbers, emails, notes and consent records that took years to build. If a former employee can still sign in, or if their deals simply stall, you lose value without noticing.

The FTC guide on protecting personal information gives clear advice. It tells businesses to have a procedure so that workers who leave or transfer no longer have access to sensitive information. It says to terminate their passwords as part of the check-out routine.

The same guide says each employee should have access only to what the job needs. It also advises knowing which employees can see consumers' personal information. A CRM is exactly that kind of system, so both ideas apply directly.

Step 1: Know Who Has Access Today

Start with a user list. Open your CRM settings and export or copy every active account, its role and its last sign-in date. Compare it against your current staff list.

Look for three problems:

• Accounts for people who no longer work for you.
• Shared logins used by several people, which hide who did what.
• Accounts with full administrator rights that do not need them.

Fix the shared logins first. A shared login makes offboarding impossible, because you cannot cut off one person without cutting off everyone.

Step 2: Give Each Role the Least Access It Needs

The FTC describes this as a need-to-know approach. Apply it by role, not by person, so the rules stay simple.

1. Sales users see their own leads and the shared pipeline, but cannot export the full database.
2. Office staff can edit contact details and log consent and opt-out changes.
3. Managers see reports and can reassign leads.
4. Administrators change settings, users and exports. Keep this group to one or two people.

Export rights deserve special care. A bulk export is the fastest way for a whole customer list to leave your business, so limit it to administrators and log each use.

Step 3: Run a Same-Day Shutdown

Write the shutdown steps down and use them every time. Here is a simple order that works for a small team.

1. Deactivate the CRM account. Do not delete it. Deactivation stops sign-ins and keeps the history your business owns.
2. Reset shared passwords. If the person knew any shared credentials, change them now.
3. Remove connected tools. Revoke email syncs, phone apps, calendar links and any automation connections tied to their account.
4. Check their email forwarding. Make sure new inquiries sent to their address land with someone else.
5. Collect devices. Get back phones, laptops and any saved sign-in sessions.

CISA, the US cybersecurity agency, advises small and mid-sized businesses to use strong, unique passwords and a password manager. It also recommends pairing passwords with multifactor authentication. A password manager makes shutdown easier, because you can rotate shared credentials in one place.

Step 4: Reassign Leads and Tasks Before They Go Cold

Access is only half the problem. The other half is pipeline hygiene. Every lead owned by a departed user is a lead nobody is watching.

Filter your CRM by the former owner and handle each group:

• Open deals: assign each to a named person, not a general inbox.
• Scheduled tasks and reminders: move them with the deal, or they will fire at an empty account.
• Active quotes: contact the customer within a day so they know who to call.
• Past clients on follow-up plans: reassign them, so check-ins do not stop.

If you have no one to take them, use a shared queue with a response rule. A queue works only if someone checks it every day, so name that person in writing.

Write a Short Handoff Note

For the biggest deals, ask the departing person to add a note in the record before they leave. Keep it to three lines: where the deal stands, what the customer promised and the next step. Notes kept in a personal notebook or private email leave with the employee.

Step 5: Protect Consent and Opt-Out Records

Departing staff often hold the freshest knowledge of who asked to stop receiving messages. Before the last day, confirm that every opt-out they received by phone, text or email is logged in the contact record.

An opt-out that lives only in someone's inbox is easy to miss. Under the CAN-SPAM Act, the FTC says you must honor an email opt-out request within 10 business days. A lost request can turn into a violation without anyone intending it.

Also check that the person did not keep a private copy of your contact list. Your onboarding paperwork should say that customer data belongs to the business and must stay in the CRM.

Step 6: Review Access Every Quarter

Offboarding catches people who leave. A quarterly review catches everything else, such as contractors whose projects ended and staff who changed roles. Set a calendar reminder and spend 20 minutes on it.

Use this short review list:

1. Compare active CRM users against your staff and contractor list.
2. Check that no account has administrator rights without a reason.
3. Look at accounts with no sign-in for 60 days and ask whether they are still needed.
4. Confirm that multifactor authentication is on for every user.
5. Check the export log for large or unexpected downloads.

Record the date and who did the review. A dated note shows you have a working routine if a customer, partner or regulator ever asks.

A Simple Rule to Adopt Today

Make one sentence your policy: no one leaves the business without a closed CRM account and a reassigned pipeline. Put it on the same checklist as returning keys and company phones.

That one habit protects your customers, keeps deals moving and proves that your customer data stays under your control.