Offboarding: the legal framework in the Netherlands

Which laws govern data access, reading emails, device retrieval, and retention periods during offboarding? Not legal advice — but a clear, practical overview.

From a legal perspective, offboarding touches three areas at once: employment law, GDPR, and potentially sector-specific regulations (healthcare, financial services). This is not legal advice — consult an employment lawyer for your specific situation.

Employment Law

\n
• Confidentiality clause in the contract — remains valid after the employee leaves.
\n
• Non-compete / non-solicitation clause — valid if recorded in writing; interpretation has been updated following the 2025 legislative change.
\n
• Return of devices and materials — should be specified in the contract.
\n
• Final pay and holiday pay settlement — must be settled upon departure.
\n

GDPR

\n
• Personal data of former employees: you may only retain what is necessary (payroll administration, tax records — typically 5–7 years).
\n
• Reading emails after departure: permitted only for legitimate business purposes and to the minimum extent necessary.
\n
• Password reset on shared accounts: required under the reasonableness standard.
\n
• Photos and data in HR systems: remove them in a targeted way after the employee leaves.
\n

Sector-Specific Rules

\n
• Healthcare (NEN 7510 + GDPR): stricter requirements; patient data logging is mandatory.
\n
• Financial services (DORA): incident reporting obligation if something goes wrong during the offboarding of an employee with system access.
\n
• Government: specific security requirements under BIO.
\n

Document Everything

Every offboarding-related decision — reading emails, buying out a device, enforcing a non-solicitation clause — should be documented in the HR file. This is your defence if a dispute arises later.

See also: offboarding pillar, HR file retention periods.