Summary
The notice period is the strangest four weeks in the employment relationship. The person has decided to go, still has every access they had last month, and is usually working hard to hand over well. It is also, by a wide margin, the period in which most insider data loss happens: not through malice in most cases, but through someone copying their own work to a personal drive because they are proud of it, or forwarding a client list because they think they will need it. Monitoring during notice has to hold two things at once: a genuine, time-limited rise in data risk, and a person who has done nothing wrong and deserves to leave with dignity. This guide covers what to tighten, what to leave alone, when garden leave is the better tool, and how to keep the whole thing proportionate.
E-Monitor's file and upload alerts can be scoped to a leaver's account for the notice period only, with the person told it is happening. Book a demo →
Where the Risk Actually Sits
The research on insider data loss is consistent on one point: the window between resignation and departure is when the majority of it happens, and most of it is unspectacular. People take their own documents, templates they built, contact lists, project files. A minority take things that are clearly not theirs. Almost none of it involves hacking; it is a USB stick, a personal email, a cloud drive, or a chat export, done by someone with legitimate access on an ordinary afternoon.
That shape of risk points to a specific response. The question is not whether to watch a leaver more closely but which few signals matter, because they are the same every time: large downloads, uploads to personal cloud storage, email with attachments to personal addresses, USB writes, and bulk exports from systems that hold customer or financial data. The confidential file detection guide covers the mechanics of each.
What to Tighten, and What to Leave Alone
A proportionate notice-period setup changes a small number of things and announces them. It does not quietly switch on everything.
| Area | During notice | Why |
|---|---|---|
| File and upload alerts | Lower the threshold for this account | This is where the risk is |
| Access scope | Narrow to what the handover needs | Least privilege, nothing personal |
| Admin and export rights | Remove on day one of notice | Bulk export is the costliest event |
| Productivity and focus metrics | Stop reading them | Irrelevant to a leaver; reading them is surveillance for its own sake |
| Screenshots | No change, or off | Rarely add evidence the file alerts do not |
| Self-access to own data | Keep it | Transparency does not end at resignation |
The fourth row surprises people. There is no decision a manager will make about a leaver's focus time, so there is no reason to look at it, and a leaver who notices that their activity score is being discussed will reasonably conclude the organisation has lost perspective. Tighten the data controls, drop the productivity lens.
Tell Them
The single most effective control in the notice period is a sentence in the resignation meeting: "As with everyone who leaves, we narrow access to what the handover needs and the system flags large file movements until your last day. Nothing else changes, and you can still see your own data." Said plainly, this does three things. It removes the ambiguity that makes people take their own work "just in case." It makes any later alert a conversation rather than an accusation. And it is, in most jurisdictions, what the law expects: monitoring that changes in intensity has to be disclosed, and a notice period does not suspend that.
What it should not be is a new policy document to sign. The leaver already consented to monitoring; what is changing is scope, and a conversation plus a short email covers it. The privacy concerns guide covers the proportionality test if the organisation wants to go further.
Garden Leave: When It Is the Better Tool
Sometimes the right answer is not better monitoring but no access at all. Garden leave, where the person remains employed and paid but is sent home for the notice period, removes the data risk entirely and is standard for roles with client relationships, pricing, source code or anything a competitor would value. It costs the salary and loses the handover, so it is overkill for most leavers and exactly right for a few.
The decision should be made on the role, not the person. If someone in a sensitive role would be put on garden leave regardless of where they are going, the policy is fair and defensible. If it is applied only to people joining competitors, it starts to look punitive and invites a dispute. The insider threat guide covers the role-based risk assessment that should sit behind the policy.
Reading an Alert Fairly
An alert during notice is a reason to ask, not a finding. A spike in downloads in the final week is usually the person collecting the handover documents the manager asked for. A zip file to a personal email is often a portfolio piece they believe is theirs. The right response to either is a same-day conversation with the file names in hand: "The system flagged these going to your personal address. Walk me through them." Most of the time the answer is innocent, the files come back, and the record shows the organisation acted promptly and proportionately. Occasionally it is not innocent, and the same record is the evidence.
What the organisation should not do is let alerts accumulate and raise them all on the last day, or after the person has gone. By then the data has left, the conversation is impossible, and the record shows alerts were ignored, which is worse in a dispute than having none.
After the Last Day
Notice-period monitoring ends when access does. Accounts are disabled on the last working day, not the following week, and the monitoring data that was collected moves into the ordinary retention schedule rather than being kept because the person left. The offboarding and retention guide covers what to keep, for how long, and how to handle a subject access request from a former employee, which is more common after a notice period that felt heavy-handed than after one that was explained.
Frequently Asked Questions
1. Can an employer monitor an employee more closely during their notice period?
Yes, within limits. Tightening file, upload and export controls for a leaver is proportionate because the notice period is when most insider data loss occurs. The change in scope should be disclosed to the person, kept to data-risk signals, and end when access is removed.
2. Should productivity be monitored during the notice period?
No. There is no decision to be made from a leaver's focus time or activity score, so reading those metrics is surveillance without purpose. Keep the data controls, drop the productivity lens.
3. What is garden leave and when should it be used?
Garden leave keeps the employee paid and employed but removes them from work and systems for the notice period. It eliminates data risk at the cost of salary and handover, and is appropriate for roles with client, pricing or code exposure, decided on the role rather than the person.
4. What should trigger an alert during the notice period?
Large downloads, uploads to personal cloud storage, emails with attachments to personal addresses, USB writes, and bulk exports from customer or financial systems. Each should prompt a same-day conversation with the file names, not an accusation.
5. Does the employee need to be told that monitoring has changed?
Yes. A change in monitoring scope or intensity has to be disclosed in most jurisdictions, and telling the person is also the most effective control, since it removes the ambiguity that leads people to copy their own work.
6. When does notice-period monitoring end?
When access is disabled on the last working day. Data collected during notice then follows the normal retention schedule and should not be kept longer because the person has left.
Tighter on data, lighter on people E-Monitor scopes file and upload alerts to a leaver's account for the notice period, keeps their self-access on, and leaves the productivity metrics alone. Sign up →