Employee departures are HR events, but they are also moments when responsibilities, records, systems and workplace access change together. A good security offboarding process in the UAE is coordinated, proportionate and respectful: it closes access that is no longer required, preserves legitimate business records, protects personal information and keeps the remaining team clear about ownership. It should support the employment process—not replace HR, legal or IT decision-making.
The useful question is not whether a departing colleague should be treated as a threat. It is whether the organisation has a repeatable way to manage routine exits, internal moves and contractor endings without relying on memory or disclosing unnecessary personal detail.
Treat offboarding as a coordinated business handover
An employment end date, final working day and access change are related but not identical decisions. HR owns the employment process; the manager owns work continuity; IT administers digital accounts; facilities or workplace teams manage relevant physical credentials and property; and information owners decide what business records must remain available. If a contracted security provider has a defined role, that role should be limited to the agreed scope and applicable authorisation.
Write down who makes each decision, who carries it out and who confirms completion. This avoids two common gaps: assuming another team has already acted, and giving a service provider more personal or employment information than it needs. Keep the coordination record factual and limited to the people responsible for the task.
Use one trigger, then review access by category
A documented HR notification can serve as the coordination trigger, provided it is shared through an approved channel and reaches named owners. The trigger should identify the change and its effective time—not circulate the reason for departure or commentary about the individual. Internal transfers and role changes deserve the same review: access that was suitable yesterday may not match today’s responsibilities.
Review access in categories rather than sending a broad request to ‘remove everything’. Consider named user accounts, shared business tools, delegated approvals, physical credentials, keys or devices, supplier portals, and records owned by the departing role. For each category, assign an owner and a completion check. Shared accounts should have a continuing business owner; do not leave an important service dependent on one person’s private login.
NIST’s current account-management control recommends aligning account-management processes with personnel termination and transfer processes. It is a useful governance reference, not UAE law and not a substitute for an organisation’s own approved procedure. See NIST SP 800-53 Rev. 5.
Protect records without retaining personal data by default
A departure can create pressure to copy inboxes, download files or preserve whole devices ‘just in case’. Those actions can expand privacy and access risks. Instead, identify the business records needed for continuity, assign a business owner, and use the organisation’s retention, legal-hold and investigation processes where applicable. Avoid informal copies of personal messages, private files or personnel records.
The UAE Government describes Federal Decree-Law No. 45 of 2021 as a framework for personal-data governance, confidentiality, privacy and security. Other regimes may apply depending on the entity and processing context, including the DIFC’s data-protection law and ADGM’s Data Protection Regulations. Confirm the applicable regime with the responsible privacy or legal adviser. See the UAE Government data-protection overview, DIFC Data Protection Law information and ADGM Office of Data Protection guidance.
Keep the process dignified and the message factual
Routine offboarding should be private, consistent and free of public speculation. Tell colleagues only what they need to know to route work, approve requests or support clients. A neutral handover message can name the successor or shared team inbox without describing the reason for departure. Do not use broad announcements to identify a person as a risk.
Exceptional situations involving a credible safety concern require a separate, case-specific plan led by qualified HR, legal and security professionals. CISA’s U.S. insider-threat guidance recommends thoughtful, respectful termination planning and attention to safety, access and property; treat it as comparative guidance, not as UAE employment law. MOHRE’s labour-relations resources and the applicable employment framework should be handled by HR and qualified advisers.
A practical checklist for the coordination owner
Confirm the authorised HR decision and the effective change time through an approved channel.
Name a coordinator and owners for IT, workplace access, equipment, records, line-management handover and any contracted support.
Review account and credential categories, including shared services and delegated approvals; assign a continuing owner where needed.
Identify business records to preserve through the approved retention or legal-hold process; do not make blanket copies.
Arrange return or reassignment of organisation property with a clear receipt or status record.
Prepare a brief, neutral communication for colleagues, suppliers or clients who need a new contact.
Record completion by category, capture approved exceptions and set a review owner for anything unresolved.
Know where employment and security rules differ
Employment steps should follow the applicable employment framework and contract, not a general security checklist. MOHRE publishes federal labour legislation and implementing materials, while organisations should confirm which framework applies to them with qualified advisers. Private-security authorisation is also jurisdiction- and service-specific: UAE legislation lists Federal Law No. 37 of 2006 concerning private security companies, and Dubai has a separate security-industry law and regulator. A UAE-wide business relationship does not by itself establish authority to provide every service in every emirate. Confirm the relevant company, activity and jurisdiction before engaging a provider; do not treat this article as legal advice.
Sources: MOHRE laws and regulations; Federal Law No. 37 of 2006; Dubai Law No. 12 of 2016 on the security industry; NIST SP 800-53 Rev. 5; and CISA Insider Threat Mitigation Guide.
Make the handover clear, not dramatic
A dependable offboarding process is visible in its ownership and completion—not in how much information it collects. Keep the routine consistent, limit sensitive details, and let HR, IT, privacy, legal and security specialists handle the decisions that belong to them. For organisations reviewing high-level security or operational-resilience planning in the UAE, visit EquiSecure or contact EquiGroup to discuss an appropriate scope. Any engagement is confirmed case by case and remains subject to applicable UAE licensing and regulatory requirements.