When They Walk, Does Your Inbox Walk With Them? Securing the Communication Channels Your Business Runs On

Ask a company director who owns their business email address and most will answer confidently: the company, of course. Ask them to prove it, and the picture becomes far less certain.

Across the UK's small and medium-sized enterprises, critical communication infrastructure — domain registrations, mailboxes, forwarding rules, contact databases — frequently sits in personal accounts belonging to long-serving members of staff. It works perfectly until that person resigns, retires or falls out with the business. At that point, the company discovers that the web of relationships and tools it relies upon daily was never actually in its control.

The Quiet Accumulation of Digital Risk

These arrangements rarely arise from bad faith. A founder sets up the domain in their own name because it was quickest at the time. An office manager configures the shared inbox under their personal Google account because the company hadn't yet invested in proper IT provision. A sales director builds a client contact list on a personal CRM because it was free and convenient.

Each decision is reasonable in isolation. Together, they create a business whose most valuable communication channels are held by individuals rather than the organisation — a structural weakness that only becomes visible when someone leaves.

What a Communication Audit Should Cover

A structured audit need not be complicated, but it should be systematic. We recommend businesses work through four areas.

Domain and registrar ownership. Check the WHOIS record and registrar account. Is the domain registered to the company, or to a director's personal email? Does the registrar account have a recovery address belonging to a former employee? A lapsed or locked domain can take a business's website, email and search rankings offline in a single day.

Mailbox administration. If you use Microsoft 365 or Google Workspace, confirm who holds the administrator credentials. Individual mailboxes should sit under a company-controlled tenant, not a personal subscription. Review forwarding rules and auto-responses periodically — departed employees sometimes leave forwarding in place that quietly diverts correspondence elsewhere.

Client and supplier contact records. Where does the master contact list live? If it exists only in a departed salesperson's phone or personal address book, the business has lost an asset it may never have formally owned. Data protection obligations under UK GDPR also apply: personal data held in personal accounts is far harder to govern, secure or delete on request.

Social and platform accounts. LinkedIn company pages, WhatsApp Business numbers and supplier portals often have a single named owner. Confirm each is transferred to a role-based account rather than an individual.

The Awkward Question of Former Employees' Contacts

One grey area causes particular difficulty. When a salesperson leaves for a competitor, may the business contact clients whose details that person held? And may the individual?

The starting position under UK GDPR is that client contact data held for business purposes belongs to the employer's business, provided it was collected in the course of employment and used with a lawful basis. In practice, enforcement action in this area — including several high-profile prosecutions pursued by the Information Commissioner's Office — has focused on individuals who deliberately exfiltrate client lists on their way out. For the employer, the lesson is preventative: hold contact data in company systems from the outset, so there is nothing to exfiltrate.

Approaching a departed colleague's clients is not legally problematic in itself, provided the approach is honest, uses data the business lawfully holds, and does not breach any restrictive covenants in the employment contract. What is problematic is attempting the approach without a functioning contact database — which is precisely the position many businesses find themselves in.

Building Resilience Before the Next Departure

Three practical steps will address the majority of the risk:

1. Move to role-based accounts. Admin access, domain management and shared mailboxes should belong to roles, not people. Use a company-controlled password manager to hold credentials.

2. Document your communication estate. A one-page register listing every domain, mailbox, platform and its owner turns an invisible risk into a manageable checklist.

3. Include communications in your offboarding process. When anyone leaves, resetting credentials, reviewing forwarding rules and reassigning account ownership should be as routine as returning a laptop.

An Asset Worth Formalising

A business's ability to communicate — with clients, suppliers and regulators — is an asset in the fullest sense. It affects valuation, resilience and, in a dispute, the ability to demonstrate what was agreed and when. Treating that infrastructure with the same formality as your bank accounts or insurance policies is not administrative pedantry; it is basic governance.

If you are unsure where your business stands, a short independent review of your communication and data ownership arrangements is a proportionate first step — ideally taken before, rather than after, the next resignation letter lands.