Data leaving with a person

The one response where the legal and HR constraints shape the technical work from the first minute rather than at the end of it. Getting the order wrong here costs the organisation the ability to act on what you find.

Trigger. A resignation with an unusual access pattern behind it, a bulk download, or a report from a manager.

The first 90 minutes1 of 5 expire

01 02 03 04 05

045 min90

01
Engage HR and Legal, and write down the authorisation
by 15 min
Before any targeted collection. Record who authorised what, and the scope and period it covers. This step is the one that makes everything after it usable.
02
Preserve first, analyse second
by 30 minexpires
Place a hold on the mailbox and file stores. Retention on a departing employee frequently shortens the moment the account is disabled by an automated joiner-mover-leaver process, which is a deadline nobody tells you about.

Tell somebody

HR and Legal, first and before collection, not afterwards
The data owner, on what the accessed material actually is
The privacy or data protection lead, if the material includes personal data of third parties

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Engage HR and Legal, and write down the authorisation

Preserve first, analyse second