Use this cloud storage offboarding checklist to preserve business records, transfer file ownership, remove unnecessary access, and close or repurpose an account safely when an employee, contractor, or family member leaves.
Overview
Offboarding a cloud account is more than downloading a few folders and deleting a user. Files may be owned by different accounts, shared through links, synchronized to personal devices, connected to third-party applications, or subject to retention requirements. A rushed handoff can cause lost records, broken workflows, exposed information, or permanent deletion.
The safest sequence is to preserve first, transfer deliberately, verify access, and only then suspend or delete the departing account. Work from an inventory rather than relying on memory. Identify the person’s owned files, shared folders, active links, devices, applications, and business records before making changes.
Provider names, administrator controls, menu labels, transfer rules, and retention periods can change. Treat the steps below as a reusable process, then confirm the current options in your organization’s Google Workspace, Dropbox, Microsoft 365, or personal-account settings before acting.
Checklist by scenario
For an employee leaving an organization
- Assign an owner. Name the manager, administrator, or records custodian responsible for the handoff. Decide which files must remain available, which can be archived, and which are no longer needed.
- Preserve evidence and records. If the departure involves a dispute, investigation, regulatory obligation, or suspected account misuse, pause deletion and follow the organization’s legal-hold or investigation process. Do not alter files simply to tidy the account.
- Inventory the account. Review owned documents, folders, spreadsheets, presentations, media, shared drives or team spaces, comments, forms, automation files, and files shared with external people. Note locations, owners, collaborators, and business purpose.
- Transfer ownership or responsibility. Use the provider’s supported administrator or sharing workflow. A copied file is not always equivalent to an ownership transfer: it may lose version history, comments, links, permissions, or connected workflows. Record the destination owner and verify the result.
- Review shared folders and links. Remove broad access that is no longer justified. Replace personal or public links with named users or approved groups where practical. Check whether external recipients still need access.
- Secure connected devices. Sign out or revoke sessions where appropriate, remove managed devices from the account, and confirm that desktop sync clients, mobile apps, and offline files are handled under company policy.
- Review third-party applications. Remove integrations that the organization no longer needs. Pay special attention to backup tools, document-signing services, automation platforms, migration utilities, and applications granted broad file access.
- Disable or suspend the account last. Before closure, confirm that the new owner can open essential files, that automated processes have a replacement account, and that recovery contacts and authentication methods are controlled by the organization.
For a contractor or temporary collaborator
Start with the contract, statement of work, and agreed return or deletion requirements. Identify files created for the project, files supplied by the contractor, and files that belong to the contractor personally. Move business records into an organization-controlled location before ending access. Review every folder shared with the contractor rather than removing only the main project folder. Also revoke invitation links, application tokens, shared links, and device sessions that could provide indirect access.
For a family member or personal account
Use a similar process on a smaller scale. Export or move photographs, tax records, identity documents, and other important files before closing an account. Check shared albums, household folders, recovery email addresses, phone numbers, and devices. For sensitive documents, avoid sending an ownership transfer through an unverified email or an unfamiliar file-sharing link. Confirm the recipient account directly before moving anything.
Platform comparison
| Area | Google Drive | Dropbox | OneDrive |
|---|---|---|---|
| Ownership | Check whether files are owned by an individual account, a shared workspace, or another organization. Use the current transfer or administrator handoff controls. | Identify the account or team space that controls each folder. Confirm whether moving content changes sharing or folder membership. | Distinguish personal work files from files in a team or SharePoint-backed location. Use the organization’s current transfer and retention workflow. |
| Shared folders | Review direct users, groups, link settings, and inherited permissions. | Review team folders, shared-folder members, links, and any external collaborators. | Review OneDrive sharing as well as team or SharePoint permissions where relevant. |
| Synced devices | Check Drive for desktop, mobile sessions, offline files, and managed devices. | Check desktop and mobile Dropbox clients, offline copies, and linked devices. | Check OneDrive sync, Office sign-ins, mobile devices, and offline copies. |
| Third-party apps | Review connected applications and OAuth-style access in the account or admin console. | Review connected apps, integrations, and services with file access. | Review connected applications, Microsoft account sessions, and automation permissions. |
| Retention and deletion | Confirm the applicable administrator retention, recovery, and legal-hold settings before deletion. | Confirm team retention and recovery settings before removing a user or folder. | Confirm organization retention, recycle-bin, and account-deletion procedures before closure. |
These are review categories, not promises that every plan includes the same control. For a deeper access review, see how to securely share sensitive documents in the cloud.
What to double-check
- Ownership is not the same as access. A person may be able to edit a file without owning it. Confirm who controls the file, who can restore it, and where it will live after the departure.
- Moving is not always copying. A copy may omit version history, comments, shortcuts, custom permissions, or integrations. Preserve the original until the destination has been tested.
- Links can outlive accounts. Review anyone-with-the-link, public, embedded, and forwarded links. Disable or narrow links that are no longer needed.
- Sync is not backup. A deletion or ransomware event can propagate through synchronized folders. Keep a separate, tested backup or archive where the risk and policy require it. The cloud backup versus sync security guide explains the distinction.
- Personal devices may retain data. Account removal does not automatically erase downloaded, cached, exported, or screen-captured files. Follow applicable device and privacy policies rather than assuming remote deletion is complete.
- Automation may fail silently. Scheduled jobs, forms, scripts, API tokens, and document workflows can depend on the departing identity. Replace credentials and test each process.
- Recovery details matter. Confirm that recovery email addresses, phone numbers, security keys, backup codes, and administrator contacts are controlled by the correct person or team.
Common mistakes
Deleting first and investigating later is the most damaging error. Suspension, preservation, and review should precede permanent deletion. Another common mistake is transferring only the visible project folder while overlooking privately owned drafts, archived material, comments, or files shared from another location.
Do not assume that removing a user from one folder removes access everywhere. Search for direct shares, group membership, inherited permissions, external links, and connected applications. Do not email sensitive exports to an address copied from an old message; verify the destination through a trusted channel.
Finally, avoid treating a successful download as proof of a successful handoff. Open representative files, test permissions with the receiving account, check important links, and document what was transferred, archived, retained, or deleted. If files appear missing, stop further cleanup and use the provider’s recovery process. Our cloud deletion and retention guide can help organize that investigation.
When to revisit
Revisit this checklist before seasonal planning cycles, employee or contractor departures, mergers, role changes, major tool migrations, and changes to shared-folder structure. Run a lighter access review when a project ends, a sensitive document is shared externally, or a third-party integration is added.
Also update the procedure whenever Google Drive, Dropbox, OneDrive, or your identity system changes its administrator controls, transfer workflow, retention behavior, or menu names. Assign someone to verify those details periodically instead of allowing an old internal checklist to become the source of truth.
For the next departure, create a dated case record containing the account, responsible owner, preservation decision, transfer destination, access review, device and application actions, verification results, and final account status. That small record turns a one-time cleanup into a repeatable cloud storage offboarding process.
