Could A Former Employee Still Access Company Data?
When employees leave, their access to company systems is not always removed quickly - or at all. Former staff retaining active accounts is one of the most common access risks inside South African organisations.
"Six months after a sales manager leaves your business, an IT flag shows an unusual login to your CRM system at 11pm on a Sunday. Investigation reveals it is the former employee's account - it was never deactivated. That account had access to your full client list, account history and contact details for every customer the business has worked with over four years."
Identity lifecycle management governs how user accounts are created, maintained and deactivated. Most SME environments lack formal identity governance tools, but Microsoft 365, Google Workspace and most SaaS platforms provide equivalent capability through native user management - it simply needs to be used systematically. Under POPIA's security safeguards condition, maintaining active accounts for former employees constitutes a failure of reasonable organisational security measures. An access review is a non-technical control: it requires only a list of active accounts compared against current staff, something any IT service provider or internal administrator can produce in minutes.
ComplyBar helps businesses identify hidden risks in how information, AI tools, email, documents and cloud systems are used.
Built for POPIA support, AI governance, data leak prevention, employee risk awareness, information governance and audit evidence.