How to stop a leaving consultant taking your candidate data with them.

Part of our complete guide to IT support for recruitment firms.

Recruitment has some of the highest staff turnover of any sector. Every departure is a window where old access sits open on a system full of candidate and client data, and a consultant moving to a competitor has every incentive to take their desk's relationships with them.

What actually walks out the door

It's rarely a dramatic data breach. It's a consultant exporting a spreadsheet of their live candidates the week before they resign, or simply keeping their email and CRM login active for a few days after their last day because nobody thought to switch it off.

The checklist for a leaver

• Revoke CRM or ATS access on their actual last working day, not whenever IT gets round to it.
• Suspend email access, and set up a forwarding or auto reply if the business needs one.
• Remove them from shared drives, job board accounts, and any e-signature or LinkedIn Recruiter seats.
• Collect company devices before their final day where possible.
• Check for any personal cloud storage (Dropbox, personal Google Drive) synced to a company laptop.

The single biggest fix: one identity system

If your firm runs on a centralised identity system such as Microsoft 365 or Google Workspace, access to everything tied to that login can be suspended in one action the moment someone leaves. Without it, offboarding means chasing down a dozen separate logins by hand, and something always gets missed.

If you're not on one identity provider yet, consolidating logins under a single system is the highest leverage change you can make here, alongside keeping a written offboarding checklist so it's never a job competing with the rest of your week.

Where this overlaps with GDPR

Candidate CVs, contact details, and often salary history are personal data under UK GDPR. A leaver who retains access, or who exports data to a personal account, is a data protection issue as much as a competitive one.