When a Staff Member Leaves: A Data Offboarding Checklist for School Admins
How to revoke access, reassign records, and protect school data when an employee departs - with a practical checklist for admins and IT managers.
Staff transitions are a routine part of school life, but they carry a data risk that is frequently underestimated. When an employee leaves - whether at the end of a contract, mid-year, or unexpectedly - their access to student records, administrative systems, and confidential data does not automatically disappear. Without a defined offboarding process, schools can find themselves with former staff who still have active logins weeks or months after departure.
This article provides a practical offboarding checklist for school admins and IT managers, covering access revocation, record reassignment, and data protection across Faria platforms and connected systems.
Access should be revoked on or before the staff member's last day - not after. Delays in this step are one of the most common data governance gaps in schools, and one of the most straightforward to fix with a clear process.
Why Staff Offboarding Is a Data Issue
It is easy to think of staff offboarding as an HR process. In practice, it is also a data governance process. A departing staff member may have had access to:
- Student academic records and assessment data in ManageBac+
- Applicant personal information in OpenApply
- Curriculum and planning documents in Atlas
- Activity and consent data in SchoolsBuddy
- Shared drives, email, and communication platforms
- Third-party integrations connected to school systems
Each of these represents a potential exposure point if access is not properly closed. In schools subject to GDPR, PDPA, or similar data protection regulations, unrevoked access to personal data after an employment relationship ends can constitute a compliance risk.
The Offboarding Checklist
Use this checklist as a starting point and adapt it to your school's specific systems and structure. The checklist is organised into three phases: before the last day, on the last day, and within one week after departure.
Before the Last Day
| Action | Owner | Notes |
|---|---|---|
| Identify all systems the staff member has access to | IT Manager | Cross-reference against your access register or permissions audit |
| Identify records, classes, or workflows assigned to this person | School Admin / Registrar | In ManageBac+: check class ownership, advisor assignments, co-curricular roles |
| Arrange handover of any in-progress tasks or student communications | Line Manager | Document who is taking over and ensure continuity for students and families |
| Identify any third-party accounts created with a school email address | IT Manager | Includes integrations, survey tools, communication platforms, and shared accounts |
| Confirm departure date and last day of access with HR | HR / School Admin | Ensure IT and admin are notified in advance, not on the day |
On the Last Day
| Action | Owner | Notes |
|---|---|---|
| Deactivate or remove the user from ManageBac+ | IT Manager / Admin | Do not delete the account if historical data is attached - deactivate to preserve records |
| Revoke access to OpenApply | Admissions Admin | Check both staff-level and any applicant-facing access |
| Remove from Atlas and any shared curriculum workspaces | Curriculum Coordinator / IT | Transfer ownership of any documents or plans they owned |
| Deactivate school email account or set an auto-redirect | IT Manager | Auto-redirect to line manager for a defined period (typically 30 days) |
| Revoke access to shared drives and collaboration tools | IT Manager | Google Drive, Microsoft SharePoint, Dropbox, Notion, or equivalent |
| Remove from SchoolsBuddy and any activity management systems | Admin / Activity Coordinator | Reassign any active sessions, clubs, or transport routes they managed |
Within One Week After Departure
| Action | Owner | Notes |
|---|---|---|
| Reassign any student records, classes, or reports to a new staff owner | School Admin / Registrar | Ensure no student is left without an assigned advisor, teacher, or key contact |
| Audit any third-party integrations linked to the departing staff member's account | IT Manager | Update API keys, shared credentials, or account ownership where applicable |
| Confirm all access has been revoked with a brief audit check | IT Manager | Run a permissions report in ManageBac+ or OpenApply to verify the account is no longer active |
| Log the offboarding in your school's HR or access register | HR / School Admin | Useful for future audits and accreditation reviews |
A Note on Deactivation vs Deletion
In most cases, deactivating a staff account is preferable to deleting it outright. Deletion can remove historical records - such as assessment data entered by that teacher, communications sent through the platform, or audit logs - that the school may need to retain for compliance or accreditation purposes.
Deactivating an account in ManageBac+ or OpenApply preserves the historical record while preventing the individual from logging in. Check with your FariaSupport contact if you are unsure which approach is appropriate for your school's data retention policy.
Tips and Considerations
- Build offboarding into your HR process - IT and admin should be notified of departures at the same time as HR begins the exit process, not after the last day
- Treat unexpected departures differently - if a staff member leaves suddenly or under difficult circumstances, access should be revoked immediately rather than waiting for a scheduled last day
- Keep a simple access register - a shared document listing which systems each staff member has access to makes offboarding significantly faster and reduces the risk of missing a platform
- Review your process annually - staff turnover patterns change, and your offboarding checklist should be reviewed at the start of each academic year
In Summary
- Access should be revoked on or before a staff member's last day - not after.
- Work through access revocation in phases: preparation before departure, action on the last day, and a verification audit within the following week.
- Deactivate accounts rather than deleting them to preserve historical records for compliance and reporting.
- Maintain an access register so offboarding is consistent, fast, and auditable.
Proper staff offboarding protects student data, supports compliance, and keeps your ManageBac+, OpenApply, Atlas, and SchoolsBuddy environments clean and accurate. FariaSupport can assist with permissions audits and account management as part of your support plan.