Your Employee Left. Does Your Company Still Own Its WhatsApp and Cloud Files?

An employee can return a laptop, hand over a door key and still be the only person who controls your customer WhatsApp number, advertising account or shared files.

For a small UAE company, this is not an abstract cybersecurity problem. It can stop orders, strand customer conversations and leave sensitive records in accounts that nobody else can administrate. The hidden risk is not the number of applications in the business. It is that nobody has an inventory of who owns or administers them.

Microsoft and Google both publish procedures for managing departing employees’ accounts and preserving workplace records. Their guidance reveals a common mistake: deletion is not the same as a controlled handover. An SME needs a sequence that protects access and continuity.

The two inventories every small business should keep

Start with a list of people and a list of systems. An employee roster tells you who works here. A systems register tells you where the company’s customer records, money flows and identity controls actually live.

A practical systems register should contain the service, account owner, admin users, recovery method, billing entity, primary data location, active integrations and a backup administrator. Add an urgency rating: an advertising account connected to a corporate credit card or a helpdesk holding customer complaints should outrank an unused newsletter tool.

Do not make a shared spreadsheet full of passwords. Record ownership and recovery responsibility there; store actual credentials and recovery material in an appropriately controlled password manager.

Offboarding starts before the exit day

The operational handover should identify: work awaiting reply, client relationships, pending orders, shared documents, delegated mailbox access, scheduled campaigns, linked payment methods, automations and the phone numbers used for customer conversations.

Before disabling accounts, establish who will receive messages and records the next morning. Before handing over shared service ownership, check whether access can be reassigned without exporting unrelated personal information. HR, the line manager and whoever administers software each have a different part of the job.

This distinction matters with company email. Microsoft’s offboarding guidance includes blocking sign-in, retaining important mail, granting another user access to needed OneDrive material and considering shared mailboxes or forwarding where appropriate. It also cautions that deletion and licence removal have retention consequences. The exact timing and options depend on the setup and any retention or legal-hold policy.

The first hour: stop access without destroying evidence

Once the employee’s authorisation ends, revoke active sessions and credentials in the organisation’s identity system. Review administrator roles, recovery contacts, authentication devices, API tokens and third-party access. Where an account might have been compromised, preserve relevant audit logs and investigate rather than simply deleting the user.

For Microsoft 365, Microsoft’s documented workflow recommends preventing sign-in, preserving required mailbox and OneDrive content and reassignment before eventual deletion. Microsoft notes that its standard account-deletion retention window is limited; that is not a substitute for a company retention policy.

For Google Workspace, ownership transfer, account suspension and archiving serve different purposes. Google advises administrators to consider transferring data and preserving a former employee’s account rather than removing it without a plan. A company using another edition or a personal Gmail account should not assume those administration tools exist in its setup.

WhatsApp is a particularly easy ownership trap

Imagine your sales representative has spent two years answering customers from a phone carrying a personally registered SIM and a WhatsApp Business account. The company pays for advertisements directing customers to that number. On the employee’s departure, who can still receive the verification code? Who controls backups, devices and linked sessions?

The answer cannot be solved by exporting a spreadsheet of phone numbers after the fact. Ownership of the telephone number, control of the device, app registration and customer-data handover are separate issues. Ideally, the business uses a company-controlled phone number and a documented operator handover rather than relying on the employee’s personal phone.

WhatsApp’s own help centre warns that changing a phone number affects account information and the usability of older cloud backups. That is one reason a hurried number change during an exit is risky. A WhatsApp Business app account is also not the same operating model as a managed WhatsApp Business Platform account with separate authorised access.

Robius has explained the operational difference between WhatsApp Business app and platform. Staff offboarding is a good moment to assess whether the company needs centralised control, but not a good moment to promise that every chat and backup can be transferred automatically.

Three high-risk exceptions

The employee is also the only administrator

Do not disable the last accessible administrator until there is a verified replacement or an approved recovery route. Confirm a second administrator can actually sign in and perform the necessary tasks. An ownership record that nobody has tested is not continuity.

The employee manages paid campaigns and billing

Advertising platforms, domains, email DNS, web hosting and subscription services can be more business-critical than the user’s ordinary inbox. A forgotten ad account linked to a departing employee’s recovery phone may not fail immediately. It fails when billing, verification or a security challenge arrives.

The employee handled regulated or sensitive records

HR, medical, financial and client data need controlled retention, access review and documented legal reasoning. Do not copy an entire personal mailbox to a manager merely because it is easy. Preserve only records the business is authorised and required to retain, in line with the relevant legal regime, contracts and investigation needs. Mainland UAE, DIFC and ADGM organisations may not have identical obligations.

A usable exit-day checklist

1. Assign a handover owner: one person accountable for open customers, files and subscriptions.
2. Verify backup administration: the company can access the service independently of the departing employee.
3. Preserve needed records: mail, documents, tickets and lawful business history before any destructive step.
4. Revoke access: active sessions, MFA devices, app permissions, keys and shared-account access.
5. Redirect active work: reassign inboxes, campaigns, customer conversations and pending invoices.
6. Audit payments: remove unnecessary cards and check for renewals or third-party spending permissions.
7. Confirm the next-day test: the replacement worker can answer the customer, open the file and recover the account.

For a 10-person firm, this is not enterprise bureaucracy. A one-page checklist and 30-minute joint HR and systems handover may prevent days of disruption.

The same register also reduces another problem Robius has discussed: employees using unapproved AI services with company information. You cannot remove access you never knew existed.

The Robius Read

Digital offboarding is not the last step in an HR process. It is a test of whether the company owns its operations or merely borrows access from individual employees.

A growing UAE SME should be able to answer two questions at any moment: who can disable access, and who can continue the customer relationship tomorrow? If those answers sit in one person’s head or phone, the problem started long before the resignation.

Sources and methodology

• Microsoft 365 administration: Remove a former employee and secure data
• Microsoft 365 administration: Preserve OneDrive and Outlook records
• Google Workspace Admin: Archive former employee accounts
• Google Workspace: Transfer data when removing team members
• WhatsApp Help Center: Changing account phone numbers and backup implications
• DIFC Commissioner of Data Protection: Guidance on records, processing and retention

Editorial method: comparative review of service-provider administration guidance and UAE-relevant operational scenarios. This is a planning checklist, not a claim of hands-on vendor testing or a universal legal retention schedule. Checked 27 October 2026.

Robius.news | Dubai, UAE | 2026 | Built to be first. Built to be trusted.