When the Password Holder Leaves: Digital Assets, Dead Accounts, and Real Business Risk

If you represent employers for long enough, you will see some version of this scenario more than once.

A key employee resigns, is terminated, becomes incapacitated, or dies.

Suddenly, no one can access the payroll portal, marketing account, benefits dashboard, recruiting platform, domain registrar, or email inbox containing years of vendor relationships. The account may be registered in the employee’s name, connected to a personal email address, or protected by authentication codes sent to a personal phone.

Then comes the panic, followed by scrambling and an expensive cleanup.

Someone usually asks, “Can’t IT just get in?”

Sometimes it can. Sometimes it cannot. And sometimes attempting to gain access creates a legal problem that the business did not anticipate. The answer may depend on account ownership, the platform’s terms of service, the nature of the account, and who has legal permission to consent to access.

Federal law, state computer crime laws, privacy rules, and platform terms may all be relevant. If the employee has died and the account is registered in that person’s name, access may also involve the employee’s estate rather than the business.

Businesses with European operations, employees, customers, or vendors may also need to consider additional privacy and data protection requirements.

Why Digital Estate Planning Matters to Employers

Estate lawyers often use the term “digital assets” to describe electronic records in which a person has a right or interest. Examples include email, social media accounts, cloud files, and online accounts.

Many states use some version of the Revised Uniform Fiduciary Access to Digital Assets Act as a framework for addressing access after an account holder’s death or incapacity. The law generally addresses access by a personal representative, agent, or trustee.

Here is the employer issue that is easy to overlook:

Wyoming law expressly provides that its fiduciary-access framework does not apply to an employer’s digital assets when an employee uses those assets in the ordinary course of business. Other states that have adopted versions of the uniform law contain similar provisions, although the language and scope can vary.

Colorado, for example, also excludes certain accounts used by business owners and managers to operate a company. The practical point is that an estate-planning statute may not solve an employer’s access problem when the employee who created or managed the account is no longer available.

If the employee opened the account in a personal name, the applicable law may provide a path for the employee’s fiduciary rather than the employer. The relevant state may also be the state where the employee lived, not the state where the company is organized or operates.

That is a warning for every employer: treat business access as a business-continuity issue, not as a family scavenger hunt.

Terms of Service Are Rules, Not Suggestions

Most online accounts are governed by terms of service. Those terms often create three significant issues.

1. Password sharing and account transfers may be restricted

Some platforms prohibit password sharing, access by unauthorized users, or transfers of personal accounts. A business should not assume that an employee’s willingness to share a password makes the arrangement permissible under the platform’s rules.

2. Accounts may be treated as personal rather than transferable

An account established with an employee’s personal credentials may not be transferable simply because the employee used it for business purposes. The name, email address, phone number, and account type used at the time of registration can affect ownership and access issues later.

3. Provider tools may control what happens after death or inactivity

Some platforms offer tools for post-death access, account inactivity, legacy contacts, or administrative succession. Under the Revised Uniform Fiduciary Access to Digital Assets Act framework, a provider’s qualifying online tool may take priority over conflicting directions in a will or similar record.

Examples include Google’s Inactive Account Manager and Facebook’s legacy contact feature. If no applicable tool or written direction exists, the provider’s terms may determine what happens next.

For employers, the practical translation is straightforward: use company administrative consoles, business-manager accounts, role-based access, and company-controlled email addresses. A second administrator should be assigned to each important platform when the provider permits it. An internal policy is useful, but it should be supported by account structures that do not depend on one employee.

Federal Laws That May Enter the Discussion

Two federal statutes often arise when someone proposes, “Let’s just log in and retrieve the files.”

Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act addresses fraud and related activity involving computers.

Even when a business believes it is acting to protect company property, accessing an account without appropriate permission may create legal risk. Whether the statute applies depends on the facts, including the scope of authorization, the account involved, and the conduct at issue. A violation of an internal policy or platform rule does not automatically establish a violation of federal law, but neither should those rules be ignored.

Stored Communications Act

The Stored Communications Act limits when certain service providers may disclose the contents of stored communications.

As a general matter, covered providers may disclose stored communications only in circumstances identified by the statute. One exception permits disclosure based on lawful consent from an originator, addressee, intended recipient, or, for certain remote-computing services, the subscriber.

The practical message for HR and operations is simple: do not build business processes around personal accounts, personal devices, or the assumption that “everyone knows the password.” Use company-controlled accounts, documented permissions, and provider tools that address ownership and consent.

The Fix: A Digital Continuity Plan

This is not merely a compliance exercise. It is an uptime issue.

A workable digital-continuity plan can help reduce payroll delays, marketing interruptions, lost sales leads, and internal disputes. It can also make organizational changes easier because account ownership and access are established in advance.

1. Inventory the accounts that matter

Do not wait for a crisis. List every account that supports revenue, payroll, benefits, recruiting, customer communications, banking operations, domain registration, cloud infrastructure, and core technology.

2. Decide who owns each account

Company-owned accounts should be connected to company-controlled email domains rather than personal Gmail or other personal accounts, where the provider permits that arrangement.

Vendor records should identify the company as the customer and should provide a process for adding or removing administrators.

3. Use provider tools instead of informal password practices

Some providers offer tools for managing access or directing what happens to account data after death or extended inactivity.

For business accounts, use administrative consoles, shared ownership structures, and role-based permissions that can remain in place when an employee changes roles or leaves the company.

4. Write a detailed offboarding checklist

Disable or modify access, transfer ownership, rotate credentials, revoke tokens, and preserve records that must be retained. Document who completed each step and when.

5. Test the single-point-of-failure scenario

If one employee becomes unavailable tomorrow, can the company still process payroll, issue invoices, support customers, and manage sales? If the answer is uncertain, the business has an avoidable continuity problem.

Wyoming-Specific Consideration

Wyoming’s statute expressly excludes an employer’s digital assets from its fiduciary-access framework when an employee used those assets in the ordinary course of business.

That provision underscores the need to treat business account access as an operational-control issue rather than assuming that an estate-planning law will resolve it.

Employer Digital Asset Continuity Checklist

This checklist can help HR, operations, and company leadership address account lockouts, data loss, and interruptions when an employee leaves, becomes unavailable, or changes roles.

A. Inventory and Ownership

• Prepare a master list of business-critical accounts, including email, payroll, benefits, banking, domain registration, cloud infrastructure, social media, advertising, customer support, CRM, and accounting systems.
• Confirm that each account is registered to a company-controlled email address where the provider permits it.
• Confirm that at least two administrators are assigned to each important platform, where supported.
• Confirm that vendor contracts identify the company as the customer and address account ownership and access rights.

B. Access Governance

• Use role-based access rather than shared passwords.
• Require multifactor authentication for administrative roles.
• Maintain a secure emergency administrative-access method with documented safeguards.
• Document who may approve access changes and how those changes should be handled.

C. Offboarding and Role-Change Procedures

• Disable or modify access at the appropriate time during a separation, consistent with applicable preservation obligations.
• Transfer ownership of accounts, pages, advertising accounts, and shared drives.
• Rotate credentials and revoke access tokens.
• Preserve business records that must be retained.
• Document each step, including who performed it and when.

D. Death or Incapacity Procedures

• Identify who has permission to act for the company.
• Identify applicable provider procedures and required documentation.
• Do not assume that a provider will release passwords.
• Use provider tools when they are available.
• Consult counsel before accessing personal accounts or private communications.

E. Litigation Readiness

• Map where business communications and records are stored.
• Establish a process for preserving relevant data while accounting for provider terms, privacy requirements, and applicable legal holds.
• Confirm that company policies address business email, device use, and records retention.

Frequently Asked Questions for HR and Business Owners

Can we use the employee’s password to access the account?

Many platform terms restrict password sharing or account transfers. Providers may also limit access under their terms. Separately, logging in may create legal risk depending on the account, the scope of permission, consent, and the surrounding facts.

Access to a company-controlled account is not necessarily treated the same way as access to an employee’s personal account. Consult counsel before accessing a personal account or private communications.

Can a provider give us the contents of stored messages?

Service providers face restrictions on disclosing message content, subject to specific statutory exceptions such as lawful consent. Whether an exception applies depends on the provider, the account, the type of information requested, and the circumstances.

What should we do first if we have a single point of failure?

Identify the five systems most important to payroll and revenue. Then establish a second administrator where supported and move ownership to company-controlled credentials through the provider’s approved process.

Conclusion

If one employee’s departure could lock the company out of critical accounts, the business should review its access policies, account ownership, and offboarding procedures.

Treaty Oak Employers’ Law Group helps employers address workplace policies, employee transitions, and legal issues associated with managing workplace access and business continuity.