Employee Offboarding Checklist for Singapore SMEs: Revoking Access on the Last Day, Not the Last Quarter

An employee offboarding checklist for a Singapore SME needs to revoke four things on the last working day, not the week after: the identity account (Google Workspace or Microsoft 365 — suspended, not deleted), Corppass and any government e-service roles held in that person's name, every shared or app-specific credential they knew, and membership of the WhatsApp groups and shared Drive folders where customer data actually sits. Most companies under 20 staff do the first one and assume it covers the rest. It does not. Under the PDPA's Protection Obligation, access that outlives employment is a reasonable security arrangement you did not make — and it is the easiest kind of failure for a regulator, an auditor or a tender evaluator to spot.

Why is an ex-employee in your WhatsApp group a compliance problem and not just an awkward one?

Because that group is a live feed of personal data. Customer names, unit numbers, phone numbers, delivery photographs, occasionally an NRIC sent by a client who should not have sent it. If someone who no longer works for you is still receiving that feed, you are disclosing personal data to a third party with no basis for it, and you have no way to stop or audit what they do with it.

Two details make this worse in practice. First, only a group admin can remove a member, and in many SMEs the admin is a staff member rather than the owner — so when that staff member leaves, nobody can clean up the group they administered. Second, removing someone does not erase the message history already on their phone. That history is gone from your control permanently. The practical implication is upstream: do not run customer-data groups where membership is unmanaged, and never let a single employee be the sole admin of a group that carries client information.

Which accounts do Singapore SMEs always forget to revoke?

The email account gets handled. These are the ones that survive, in rough order of how often we find them still active:

• Corppass roles. Government e-services — IRAS, CPF, MOM's work pass system, GeBIZ — are accessed through an individual's Singpass under your Corppass. If you do not remove the user in Corppass, a former employee's personal Singpass still opens the door to your tax and payroll filings. This is the single highest-consequence item on the list and the most commonly missed.
• Shared logins. The POS admin password, the Wi-Fi router, the Shopee or Lazada seller account, the domain registrar, the social media accounts. If a password was known rather than assigned, it has to be changed, not revoked.
• 2FA tied to a personal phone. If the bank token, the WhatsApp Business number or the registrar's verification code lands on the departing person's handset, you have handed them a veto over your own recovery.
• Drive and SharePoint ownership. Suspending an account does not reassign what it owns. Files stay in their My Drive, and if you later delete the account you can delete the folder with it.
• OAuth connections and API keys. Third-party apps they authorised, personal access tokens, the Zapier or Make connection running your lead routing. These keep working after a password change.
• Physical and building access. Office keys, the access card, the alarm code, the padlock combination on the store.

What does the revocation sequence look like in order?

Order matters, because doing it in the wrong sequence either locks you out of something or tips off someone who still has access.

1. Transfer ownership first. In Google Workspace, reassign Drive files and any calendars, groups or forms they own. In Microsoft 365, set a manager on the OneDrive before you touch the account.
2. Suspend the identity account — never delete it on day one. Suspension kills active sessions, keeps the mailbox intact for the handover, and preserves the audit trail. Use Google's "reset sign-in cookies" or revoke refresh tokens in Entra ID so existing logged-in sessions on their laptop and phone die immediately.
3. Remove Corppass roles and any named government access.
4. Rotate every shared credential they knew. Then put the rotated ones in a password manager so the next exit is a revocation rather than a rotation.
5. Move 2FA and recovery numbers to a company-controlled number or an authenticator the company holds.
6. Remove group and channel membership: WhatsApp groups, Telegram, Slack, shared mailbox delegation, the vendor portals.
7. Collect devices and physical access, and if they used a personal phone for work mail, wipe the work profile rather than the phone.

For a sub-20-person company this is a 45-minute job if the list exists, and a three-week trickle of discoveries if it does not.

What changes now that your team uses AI tools?

AI accounts are the newest blind spot. A departing staff member may have a ChatGPT or Claude account containing months of pasted customer records, a Gemini or Copilot history inside your own tenant, a custom GPT built on your pricing, or an API key billed to your card. If the AI subscription was signed up with a personal email, you cannot revoke it and you cannot see what is in it — which is the real argument for issuing AI tools through company accounts rather than reimbursing personal ones. Add a single line to your offboarding list: every AI tool, which account it was on, and whether company data went into it.

How do you prove offboarding actually happened?

Keep a one-page record per departure: date, items revoked, who revoked each one, and a timestamp. A spreadsheet is enough. This matters for three reasons — it turns offboarding from memory into process, it is the first evidence a PDPC enquiry or a cyber-insurance claim will ask for, and it is the kind of control a Cyber Essentials assessor or an enterprise tender questionnaire expects you to be able to show. An undocumented revocation and a forgotten one look identical from the outside.

The structural fix is to reduce how much there is to revoke. Named accounts instead of shared ones, group-based permissions instead of per-person file shares, a password manager instead of a WhatsApp message titled "passwords", and company-owned phone numbers for anything that receives a verification code. Do that once and every future exit becomes a checklist instead of an investigation.

FAQ

Should we delete or suspend a departing employee's email account?
Suspend it, and keep it suspended for a defined period — 90 days is a common choice — before deleting or converting it to an archived licence. Suspension ends their access immediately while preserving mail, calendar and files for handover and for any later dispute. Deleting on day one destroys evidence you may need and can take owned files with it.

Can we legally keep a former employee's work emails?
Yes, where you have a legitimate business or legal reason — tax records, contractual correspondence, warranty and claims history. The PDPA does not require you to purge business records on departure, but it does expect you to stop retaining personal data once the purpose has ended. Set a retention period, write it down, and apply it rather than keeping everything forever by default.

What if the departing employee is the only administrator of an account?
Fix that before the exit, not during it. Add a second administrator — usually the owner — to every critical system while the person is still cooperative, including WhatsApp groups, the domain registrar, Workspace or Microsoft 365, Corppass and all marketplace seller accounts. Recovering a sole-admin account after someone has left, especially one verified against their personal phone, ranges from slow to impossible.