April, 2026 | Article

Author Nolan Witkowski

In April 2024, a worker employed by a major Ontario commercial cleaning company was terminated without cause. Although he accepted severance and signed a release of all employment claims, he was so incensed by the termination that he downloaded his entire work drive before leaving, including a staff directory and confidential client financial information. Then he used that data in an extended harassment campaign against his former employer and manager.

This scenario plays out at law firms across Ontario more regularly than we’d like to admit. A difficult departure (e.g. a firing, layoff, or resignation after a dispute) can make it easy to forget that the former employee still has access to your systems and files. By the time it’s noticed, the damage has already been done.

Fortunately, the risks are preventable, but the first step is taking a hard and honest look at your firm’s offboarding process.

What Can a Departing Employee Access at Your Firm?

When you think of misappropriation, you may picture a disgruntled ex-employee walking out the door with a USB drive full of company files. While that still happens, they’re more likely to quietly copy, forward, or download information while they still have access.

Think about what the average legal assistant or paralegal at your firm works with every day: client files, billing records, contact lists, internal memos, and often trust account documentation. They can forward emails to a personal account, upload documents to a private Google Drive folder, or take screenshots of confidential information. Unless you’re actively monitoring them, they can do it without your knowledge.

The situation gets more complicated with staff who have administrative or elevated system privileges. An IT coordinator, a senior paralegal who manages the DMS, or a practice group administrator may have access to entire folders of client files. When they leave under difficult circumstances, the fallout can span the firm's entire client base.

Where Offboarding Usually Goes Wrong

Most law firms have a checklist for when someone leaves. Return the keys, collect the laptop, cancel the parking pass. The digital side of offboarding is less concrete, which is exactly why it gets handled inconsistently (or skipped entirely) until something goes wrong.

No Bridging the Gap

The most common failure is the gap between an employee's last day and the day their accounts are actually disabled. In a busy firm, the office manager notifies the partners, HR processes the paperwork, and someone sends an email to IT. If that email goes unanswered over a weekend, or if IT is handling something else, the former employee's login credentials stay active. They still get client emails, their remote access stays active, and they can still open every file they had permission to view.

Access Remains Active

The second failure is incomplete access revocation. Disabling someone's email account is not the same as removing their access to every system the firm uses. A firm running Microsoft 365, a practice management platform like Clio or PCLaw, a client portal, a billing system, and a shared cloud drive has at least five separate places where that person's credentials need to be revoked. If the party handling the offboarding doesn't have a complete inventory of which systems the employee used, some of those accounts will stay open, sometimes for months afterward.

The Timing Problem Nobody Talks About

When an employee gives two weeks' notice and leaves on good terms, there's time to plan the transition carefully. When someone is let go, especially when the termination is contested or acrimonious, the window between the conversation in the boardroom and the moment that person walks out the door can be as short as twenty minutes. That's not enough time to revoke access properly if your firm doesn't have a plan already in place.

Law firms should treat access revocation as something that happens simultaneously with (not after) the termination conversation. There should be coordination between the office manager, HR, and IT before anyone sits down in that boardroom. It means having a single point of contact who can disable accounts in real time, and knowing in advance exactly which systems need to be addressed, in which order, and by whom.

What Your IT Provider Should Be Doing

If your firm relies on an external IT provider, you should discuss offboarding with them. A good IT provider will have an offboarding procedure that covers every system your firm uses, and they can execute it quickly when you call. If you're not sure whether your provider can do this, ask them directly: what happens when we need to terminate someone's access immediately? How long does it take? Who do we call?

Your IT provider should be able to revoke remote access, disconnect active sessions on any device, disable multi-factor authentication tokens tied to that employee's phone, and remove their credentials from every integrated platform your firm runs. They should also be able to pull an access log showing which files that employee opened or downloaded in the days leading up to their departure. That log won't undo the damage if something was taken, but it tells you exactly what you're dealing with, which is the first thing you need to know if a Law Society complaint or a civil claim follows.

Your IT provider should also be managing your firm's mobile device policy. If your staff accesses client files on their personal phones, those connections need to be severed at departure too. A remote wipe of firm data from a personal device is a standard capability that any managed IT provider should be able to execute. If yours can't, that's a gap worth addressing right now.

Building a Departure Protocol That Protects Your Firm

The law firms that handle departures well (even ugly ones) are the ones that know which systems need to be addressed, in what order, and who is responsible for each one.

Start by mapping every system a typical employee can access at your firm. Then assign clear ownership: the office manager normally coordinates the departure, but the actual account disabling usually sits with IT. Review the protocol at least once a year, and update it every time your firm adds a new software platform.

A departure handled well (even a difficult one) rarely makes headlines. On the other hand, a departure that results in a data breach or a Law Society complaint can affect the firm for years. The difference between the two is almost always preparation, so start the conversation with your IT provider now, before the next difficult departure forces it.

Nolan is an expert in IT for law firms. In 2024 he became CEO of IT support company Inderly, local to Hamilton and Toronto and serving law firms across Ontario.

When not leading the Inderly team, Nolan can usually be found writing and shooting independent films, playing D&D, or enjoying Toronto’s best theatre productions and concerts.