Introduction
DPDPA Clause 8(7)(a) requires Data Fiduciaries to erase personal data and cease processing as soon as it is reasonable to assume that the specified purpose for which personal data was collected is no longer being served. For workforce data, employment termination is the clearest trigger for this determination. When an employee leaves, the employment relationship that justified processing their personal data ends. The processing purpose, executing the employment contract, is no longer being served.
At the access layer, this translates to a direct technical obligation: when an employee whose role required access to personal data systems leaves the organisation, their access to those systems must cease. Promptly, completely, and with a documented audit trail. The Clause 8(7) obligation is not satisfied by removing the employee from Active Directory while leaving their accounts active in three SaaS applications and their SSH keys on two production servers.
The offboarding gap is pervasive. Exit processes at most organisations are built around payroll, benefits, and asset return. IT offboarding, covering access revocation across all connected systems, is either a secondary step that depends on a separate IT ticket or a manual checklist that individual system administrators work through. Both approaches produce incomplete, delayed, and undocumented deprovisioning. Neither satisfies Clause 8(7)’s technical obligation.
This blog covers what Clause 8(7) specifically requires for employee offboarding, the technical infrastructure required to satisfy it, the evidence the Data Fiduciary must produce, and how automated deprovisioning workflows address both the access cessation and documentation requirements.
What Clause 8(7) Requires for Employee Offboarding
Clause 8(7) has two sub-clauses with different triggers but overlapping technical requirements.
Clause 8(7)(a): Purpose completion trigger
Clause 8(7)(a) requires erasure and cessation as soon as it is reasonable to assume the specified purpose is no longer being served. For workforce personal data, the specified purpose is executing the employment relationship: payroll processing, benefits administration, performance management, and access provisioning for the employee’s role.
When employment ends, the employment relationship purpose is no longer being served. The Clause 8(7)(a) trigger for workforce offboarding is employment termination as recorded in the HR system.
The reasonably assume standard implies a prompt response to the trigger event. An organisation that processes personal data of a departed employee for months after their termination because IT offboarding was delayed cannot reasonably claim that the purpose is still being served. The trigger has occurred. The obligation to cease processing begins from the trigger.
Clause 8(7)(b): Consent withdrawal trigger
Clause 8(7)(b) requires erasure and cessation when the Data Principal withdraws consent and no other lawful basis applies. For workforce data processed on the basis of consent, withdrawal triggers the same access cessation obligation as employment termination under Clause 8(7)(a).
For customer-facing systems, consent withdrawal by a customer is the Clause 8(7)(b) trigger. The access cessation at the customer data layer, removing the customer’s data from active processing systems, is the technical equivalent of the employee access revocation at the workforce layer.
The distinction between access cessation and data erasure
Clause 8(7) requires both cessation of processing and erasure of personal data. These are related but technically distinct obligations.
Cessation of processing means the departed employee’s access to personal data systems is revoked. They can no longer log in to the HR system, the CRM, the document management platform, or any other system they were entitled to use during employment.
Data erasure means the employee’s personal data that was collected and processed during employment is deleted after the retention period required for legal compliance has passed. Payroll records may need to be retained for tax compliance. Employment records may need to be retained for a defined period. The erasure obligation applies after these retention periods expire.
The IT team’s primary Clause 8(7) obligation at the point of offboarding is access cessation. Data erasure following the retention period is a data governance function that requires a separate retention and deletion schedule.
The Technical Infrastructure Required for Compliant Offboarding
Compliant Clause 8(7) offboarding requires an automated deprovisioning workflow that covers all connected systems, completes within the same business day of the employment termination event, and produces a complete audit trail.
HR system integration as the deprovisioning trigger
The deprovisioning workflow must be triggered automatically by the HR system event recording the employment termination. Manual triggers, where an IT ticket is raised after HR records the departure, create a gap between the trigger event and the access cessation. During this gap, the departed employee may retain access to personal data systems.
HR system integration through SCIM or API enables the IAM platform to receive termination events in real time. When the HR system records a termination, Akku’s User Lifecycle Manager receives the event and initiates deprovisioning across all connected applications simultaneously.
The trigger mechanism eliminates the dependency on human memory or process adherence. Deprovisioning occurs because the system received the trigger, not because an IT administrator remembered to raise a ticket.
Comprehensive application coverage
Deprovisioning must cover every application the departed employee had access to. Not just Active Directory. Not just the primary business applications. Every connected application, including legacy systems, custom-built tools, SaaS applications, and infrastructure access.
The coverage requirement is what makes manual deprovisioning at scale problematic. A departing employee at a mid-market organisation may have access to 15 to 30 applications. A manual deprovisioning process requires the IT administrator to access each application separately, locate the user account, and disable or delete it. The process is time-consuming, error-prone, and inconsistently applied.
SCIM-based automated deprovisioning propagates the termination event to every connected application simultaneously. Each application receives a structured deprovision request and returns a confirmation. The deprovisioning is comprehensive and the confirmation is logged.
Privileged access revocation
For employees with privileged access to infrastructure, deprovisioning must extend beyond application accounts to SSH keys, database credentials, API keys, and any other credentials the employee held.
Per-session ephemeral credentials through AkkuArka address this structurally: because privileged users hold no standing credentials to target systems, there are no standing credentials to revoke. Access to infrastructure is governed through the PAM platform, and removing the employee’s PAM platform access simultaneously removes their ability to request privileged sessions to any target system.
For organisations that issued standing SSH keys or database credentials before implementing PAM, the offboarding process must include explicit revocation of these credentials alongside the application account deprovisioning.
Same-day completion requirement
DPDPA’s promptly implied standard means access cessation must complete within the same business day as the employment termination event. A deprovisioning process that takes three days to work through the checklist does not satisfy the prompt cessation requirement.
Automated deprovisioning triggered by HR system events completes in minutes, not days. The trigger fires when HR records the termination. Deprovisioning requests are sent to connected applications immediately. SCIM confirmations are received within minutes for most connected applications. The complete deprovisioning process, from HR trigger to confirmed access removal across all connected systems, can complete within a business hour rather than a business day.
The Audit Evidence Clause 8(7) Requires
Clause 8(4)’s demonstrability requirement means the Data Fiduciary must be able to prove that access ceased when the processing purpose was no longer served. For offboarding, this requires a structured deprovisioning audit trail.
What the deprovisioning audit trail must contain
The trigger event: the HR system termination record with the termination timestamp. The deprovisioning execution: which applications were deprovisioned, the deprovisioning action taken, and the execution timestamp for each. SCIM sync confirmation: the confirmation response from each connected application, with timestamp. The complete record must cover every system the employee had access to, not only the systems where deprovisioning was confirmed successful.
Handling SCIM connector failures
When a SCIM connector fails, the deprovisioning request is sent but the confirmation is not received. The IAM platform records show the deprovisioning was initiated but not confirmed. This is an incomplete deprovisioning record.
Akku’s connector health monitoring detects SCIM failures and flags them for immediate administrator attention. The failed sync is logged alongside the deprovisioning record, creating a complete picture of what occurred: deprovisioning was initiated, the sync failed, the failure was detected and flagged. The administrator can then manually complete the deprovisioning for the affected application and record the manual action.
The critical point is that connector failures must be detected, not allowed to persist silently. An undetected connector failure means a departed employee’s account persists in a connected application for an indefinite period, with no indication in the IAM platform that the deprovisioning was incomplete.
Retention of deprovisioning records
Deprovisioning records must be retained for a period sufficient for regulatory examination. The trigger event record, the deprovisioning execution record, and the confirmation records together constitute the Clause 8(7) compliance evidence. These records should be retained for a minimum of three years, consistent with the general retention practice for compliance evidence.
What Happens to Personal Data After Access Is Revoked
Access revocation under Clause 8(7) at the offboarding point is the immediate compliance obligation. The longer-term data retention and erasure obligations require a separate data governance programme.
Employee personal data retention
Payroll records, employment contracts, performance records, and other employment-related personal data may need to be retained after termination for tax compliance, employment law requirements, or legal dispute resolution. The applicable retention periods depend on the legal requirements in the jurisdictions where the employee worked.
During the retention period, the personal data is retained but processing should be limited to what the retention requirement necessitates. Active use of the data for operational purposes beyond the retention obligation is inconsistent with Clause 8(7)(a)’s purpose completion requirement.
Scheduled deletion after retention period
After the applicable retention periods expire, the employee’s personal data should be scheduled for deletion. The deletion schedule should be defined in the data retention policy, technically enforced through the data management infrastructure, and produce an audit record of the deletion event.
The scheduled deletion at retention period expiry is the completion of the Clause 8(7)(a) obligation that began with access revocation at offboarding. The full compliance evidence chain runs from employment termination through access revocation to scheduled deletion.
Diagnostic Questions
When an employee is terminated today, does their access to all personal data systems cease within the same business day through an automated deprovisioning workflow triggered by the HR system, or does cessation depend on a manual IT ticket?
Does your deprovisioning coverage extend to every application the employee had access to, including legacy systems, custom tools, and infrastructure access, or only to the primary directory and main SaaS applications?
For employees with privileged infrastructure access, does offboarding revoke their SSH keys, database credentials, and any other standing credentials to production systems, or only their application accounts?
Is there a complete deprovisioning audit trail for every employee who left in the last 12 months, covering every system from which access was removed, with timestamps and SCIM sync confirmations, and are connector failures flagged for remediation?
Does your data retention policy define how long each category of employee personal data is retained after termination, and is scheduled deletion after retention period expiry technically enforced with an audit record of each deletion?
CTAs
See how Akku’s User Lifecycle Manager addresses DPDPA Clause 8(7) offboarding requirements through HR-triggered automated deprovisioning, SCIM coverage, and complete audit trail generation.
Book a conversation with the Akku team to assess your current offboarding process against DPDPA Clause 8(7)’s access cessation and documentation obligations.
FAQs
What does DPDPA Clause 8(7)(a) require specifically for employee offboarding, and how quickly must access be revoked?
Clause 8(7)(a) requires erasure and cessation as soon as it is reasonable to assume the specified purpose is no longer being served. For employee offboarding, employment termination is the trigger event. The reasonably assume standard implies a prompt response: access to personal data systems should cease on the day of termination, not days or weeks later. While the Act does not specify an exact timeframe, same-day cessation is the standard that satisfies the prompt obligation. An organisation that typically completes deprovisioning three to five days after termination cannot claim the delay is reasonable when automated deprovisioning infrastructure is available that completes the process in minutes.
Does DPDPA Clause 8(7) apply to all employee data or only to personal data systems?
Clause 8(7)(a) applies to personal data the organisation processes for the employment purpose. This covers all personal data collected and processed as part of the employment relationship: HR records, payroll data, performance records, and access to any system where the employee’s personal data or the personal data of others was processed in the course of their role. At the access layer, the obligation applies to every system the employee had access to, because their role in those systems was connected to the employment purpose. At the data layer, the obligation covers the employee’s own personal data held by the organisation, subject to applicable legal retention requirements.
How does the DPDPA offboarding obligation interact with legal retention requirements for employee records?
Legal retention requirements create an exception to the erasure obligation under Clause 8(7). Where personal data must be retained for tax compliance, employment law requirements, or potential legal disputes, the retention is lawful under the legal obligation basis rather than the employment contract basis. During the retention period, processing must be limited to what the retention requirement necessitates. The access cessation obligation at offboarding applies immediately: the employee’s access to operational systems is revoked. The data retention obligation allows the data itself to be kept for the required period, after which scheduled deletion completes the Clause 8(7)(a) obligation.
What is the risk of incomplete offboarding from a DPDPA compliance perspective?
Incomplete offboarding creates two simultaneous risks. The security risk: a departed employee with persistent access to personal data systems can access, copy, or exfiltrate data they are no longer authorised to process. For high-risk departures such as employees leaving for competitors or employees dismissed for cause, this risk is acute. The compliance risk: persistent access after employment termination is a direct Clause 8(7)(a) violation. If a Data Principal whose data was processed by the departed employee files a complaint with the Data Protection Board alleging unauthorised access to their data, the organisation cannot demonstrate that access ceased promptly. The deprovisioning gap becomes both a security incident and a regulatory finding simultaneously.
Can the same automated deprovisioning workflow satisfy both DPDPA Clause 8(7) and ISO 27001 A.5.16 simultaneously?
Yes. DPDPA Clause 8(7)(a) requires cessation of processing when the purpose is no longer served, which for workforce offboarding means access revocation on employment termination. ISO 27001:2022 A.5.16 requires that identity deletion follow a managed process with documented evidence. Both requirements are satisfied by an automated deprovisioning workflow triggered by HR system events, covering all connected applications, completing within the same business day, and producing a structured audit trail with SCIM sync confirmations. The same workflow, the same trigger, and the same evidence satisfy both frameworks simultaneously.
What should organisations do when they discover that a departed employee still has active accounts in connected applications due to SCIM connector failures?
When a SCIM connector failure is discovered that left a departed employee’s account active in a connected application, the organisation must take three immediate actions. First, manually disable or delete the account in the affected application immediately. Second, investigate whether the account was accessed after the termination date: the application’s access logs should be reviewed for any activity between the termination date and the discovery date. Third, assess whether the activity, if any, constitutes a personal data breach under DPDPA Clause 8(6) requiring notification to the Data Protection Board and affected Data Principals. The discovery, remediation, and breach assessment must all be documented in the audit trail as evidence that the organisation responded promptly when the failure was identified.