Last reviewed 10 September 2026
Discovering that someone who has just left is contacting your clients, or that files were copied to a personal account in their final weeks, is one of the most disruptive things a growing business faces. It also carries a risk of overreacting.
In England and Wales the position depends on the contract of employment, any restrictive covenants, the duties owed during employment, the treatment of confidential information and, where personal data was taken, data protection obligations that fall on you as well as on the individual.
This guide is general information about handling that situation. It is not legal advice, and you should take advice on your own circumstances before sending threats, contacting clients about the individual or applying to court.
Secure the evidence first
Preserve the leaver's mailbox, device images, file access logs, CRM export records and remote access logs before anything is wiped or reissued. Once a laptop is reimaged or an account deleted, the most valuable evidence is normally gone for good.
Record who found what and when. A short internal note made at the time, with screenshots and log extracts attached, is far more useful than a recollection assembled weeks later.
Read the contract before deciding anything
Look for confidentiality obligations, provisions about company property and data, garden leave, notice provisions and post termination restrictive covenants such as non solicitation of clients, non dealing and non competition.
Restrictive covenants are enforceable only so far as they go no further than is reasonably necessary to protect a legitimate business interest, judged when the contract was made. Scope, duration and geography all matter, and a covenant that is too wide can be unenforceable.
Confidential information and trade secrets
Even without a covenant, employees owe duties of confidence, and material such as pricing models, client lists, tender documents and technical know how may be protected. General skill and experience the person has acquired is not.
Whether something is genuinely confidential depends on how the business has treated it: access controls, labelling, restricted sharing and clear policies all support the argument that the material was more than everyday know how.
Where personal data is involved
If client contact details or other personal data have been taken, this is also a data protection issue for your business. Consider your obligations under the UK data protection regime, including whether the incident needs to be recorded internally, reported, or communicated, and take advice quickly because the assessment is time sensitive.
Do not let the data question be forgotten in the middle of the commercial argument. Regulators look at how the organisation responded, not only at what the individual did.
The options open to you
Options run from a measured letter reminding the individual and their new employer of the obligations and asking for the return and deletion of material, through undertakings recorded in writing, to court applications for injunctive relief and delivery up in the most serious cases.
Urgent court applications are demanding and expensive and require you to move promptly, because delay undermines the argument that relief is urgently needed. Many situations are resolved by a well evidenced letter that makes clear what has been preserved.
Protecting the client relationships
Speak to affected clients about your service and continuity, not about the individual. Avoid saying anything about the leaver that you cannot evidence, because defamatory statements create a second dispute alongside the first.
Then fix the underlying gaps: proportionate covenants in new contracts, an offboarding checklist, restricted bulk export from the CRM, and clear policies about company data on personal devices.
Key points
- Preserve devices, accounts and access logs before reissuing anything.
- Covenants are enforceable only so far as they are reasonably necessary.
- Confidential information can be protected even without a covenant.
- Taking client personal data raises data protection duties for your business too.
- Act promptly, because delay weakens any urgent application.
- Talk to clients about continuity, not about the individual.
Frequently asked questions
- Are restrictive covenants enforceable in the UK?
- They can be, but only so far as they go no further than reasonably necessary to protect a legitimate business interest. A tightly drawn non solicitation clause for a limited period is generally easier to enforce than a broad ban on competing.
- The employee emailed files to a personal account. Is that enough to act on?
- It is a strong starting point, but what matters is the nature of the material, what the contract and policies say, and what has happened since. Preserve the evidence and take advice before confronting the individual.
- Can I contact the new employer?
- Often yes, and a factual letter setting out the obligations is a common step. It should be measured and evidenced, because inaccurate allegations can create liability for your business.
- What if a client simply chose to follow them?
- Clients are free to choose their suppliers. The question is whether the individual breached an enforceable obligation, such as soliciting or dealing with that client during a restricted period, rather than whether the client moved.
- How quickly do I need to act?
- Quickly. Evidence disappears when accounts and devices are recycled, and delay undermines any application for urgent relief. Preserving material on day one keeps every option open.