When someone leaves, most small businesses ask a practical question first: how do we keep access to what matters?

That is the right starting point, but it is not the only one.

Former employee email and data is really a governance question. You need to decide whether the business still needs active use of that mailbox, whether the content must be retained for compliance or legal reasons, and whether recovery needs are separate from either of those.

That is why shared mailbox, inactive mailbox and backup are not interchangeable.

The three options, and what each is for

Shared mailbox

A shared mailbox is useful when the business still needs ongoing operational access to incoming email or mailbox content as part of a live handover.

For example, a salesperson leaves and customer emails still need to reach the team.

Inactive mailbox

An inactive mailbox is useful when the mailbox content needs to be retained after the user leaves for regulatory, compliance or legal reasons, without keeping it as an active working mailbox.

That is a different use case from day-to-day team access.

Backup

Backup is about recovery.

It helps when you need to restore content after deletion, corruption, ransomware or user error. It does not replace a decision about who should access a former employee’s mailbox, or whether data must be retained under policy.

When a shared mailbox is appropriate

A shared mailbox is usually appropriate when:

• the role is being handed over

• incoming email still needs to be received and actioned

• another employee or team needs ongoing operational access

• the mailbox is still part of live business activity

This is an access and continuity choice.

When an inactive mailbox is the right choice

An inactive mailbox is more appropriate when:

• the user has left permanently

• the business needs to preserve mailbox content

• retention obligations matter more than day-to-day mailbox use

• access should be controlled through compliance-oriented processes rather than routine team use

This is a retention and governance choice.

Where backup fits, and where it does not

Backup is important, but it answers a different question.

It supports recovery readiness. It does not decide whether the mailbox should remain actively accessible, nor does it replace retention policy. If a business treats backup as its only answer to former employee data, it often ends up mixing up three different needs:

• live handover

• retained records

• point-in-time recovery

Those need separating.

A simple decision matrix for SMEs

Ask these questions in order:

1. Does the business still need active incoming email to that address?

2. Does the mailbox need to be retained for compliance, legal or records purposes?

3. Does the business also need a recovery path for accidental deletion or other restore scenarios?

If the answer is mainly operational continuity, shared mailbox handling is often the right route.

If the answer is mainly retention, inactive mailbox handling is often more appropriate.

If the answer is recovery readiness, backup belongs in the picture as a separate control.

Final thought

The mistake SMEs often make is assuming shared mailbox, inactive mailbox and backup are substitutes for one another.

They are not. One is mainly for ongoing business use, one is mainly for retention, and one is mainly for recovery. The right answer depends on what the business actually needs after the employee has left.

Book a Security Triage Call

FAQs

What should you do when an employee leaves?

Immediately: disable their account, revoke all access (email, files, collaboration platforms), transfer ownership of shared documents, and update any automated processes that reference their account.

How do you ensure a former employee cannot access company data?

Disable their account immediately, change passwords for any shared accounts they knew, review access logs to confirm no data was exfiltrated, and ensure their devices are returned or remotely wiped.

What is the risk of not properly offboarding an employee?

Former employees with active access can delete data, steal information, or cause security incidents. Even after account deactivation, cached data on their devices may still contain sensitive information.

Learn about the Security Baseline Review