GDPR in 2026: Why Manual Offboarding Is Now a Data Protection Liability

Manual offboarding was once considered adequate if you had a policy and checklist. In 2026, with coordinated GDPR enforcement zeroing in on the right to erasure and intensified scrutiny of security controls, that approach is obsolete. Today, spreadsheet-driven offboarding and SSO-only deprovisioning are turning up in investigations, fines, and failed audits.

Executive summary

In 2026, GDPR regulators aren't asking if you document offboarding-they're demanding proof that access and data are actually revoked across every system when contracts end or the right to erasure is invoked.

Under GDPR, authorities can impose administrative fines up to €20 million or 4% of global annual turnover, whichever is higher.^1balkan.id With the EDPB's 2025-2026 coordinated enforcement targeting the right to erasure, orphaned accounts and manual offboarding are clear liabilities for both data protection and cybersecurity.^{2edpb.europa.eu}

This article covers:

• How GDPR enforcement in 2026 focuses on storage limitation, deletion, and live audit evidence
• Why manual and SSO-only offboarding create direct GDPR exposure
• What regulators now expect in offboarding controls and audit trails
• A practical blueprint for automated, evidence-driven offboarding-and where platforms like Iden fit

The 2026 GDPR shift: from policies to proof

GDPR has been in force since 2018. What's changed is how and where regulators look for compliance failures.

Coordinated enforcement on the right to erasure

In February 2026, the European Data Protection Board (EDPB) released a coordinated enforcement report on the right to erasure (Article 17), leveraging work by 32 supervisory authorities.^{2edpb.europa.eu}

Throughout 2025, 32 DPAs participated, with 9 launching or continuing formal investigations and 23 conducting fact-finding exercises on erasure implementation.^{2edpb.europa.eu}

Key takeaways:

• Controllers struggle to set and enforce retention periods.
• Many can't reliably delete or anonymize data in all systems-including backups and distributed SaaS.
• There's a disconnect between written erasure policies and actual technical execution-the precise gap manual offboarding and orphaned accounts create.

Recent guidance raises the bar on retention and deletion:

• Data protection authorities (e.g., CNIL, Garante) have penalized organizations for retaining personal data-including employee metadata-beyond necessity, citing storage limitation (Article 5(1)(e)).^{3dlapiper.com}
• Over 60% of failed GDPR audits in 2024 resulted from fragmented documentation and inadequate evidence on deletion and retention controls.^4isms.online

The message is clear: Deletion and offboarding are now top enforcement targets-not just hygiene.

2026: multiple regimes, one offboarding problem

2026 isn't just "more GDPR." It's the first year where several overlapping frameworks apply at once:

• NIS2 (including Germany's NIS2 Implementation Act) expands security obligations and raises fines up to €10 million or 2% of global turnover for key entities.^5mofo.com
• DORA is fully applicable from 17 January 2025, making access governance a board-level issue across the EU financial sector.^{6eba.europa.eu}

All ask: Can you track, system by system, when access was removed and data deleted or minimized?

Manual offboarding can't answer that at scale.

Why manual offboarding fails GDPR in practice

Most high-growth companies offboard like this:

• HR sends a leaver list on Friday
• IT updates SSO and a few critical systems
• Someone checks "everything else" when they have time
• Evidence lives in scattered tickets, emails, or Slack threads

On paper, you have policy. In reality, identity blindspots-and GDPR now counts them as control failures.

Orphaned accounts vs. GDPR principles

An orphaned account: a user credential that persists even after the user's exit or change in role, with ongoing access to internal or customer data.

By 2025, the average enterprise runs roughly 275 SaaS apps, making it easy for dozens of accounts to slip through during offboarding.^7josys.com

These violate core GDPR principles:

• Lawfulness & purpose limitation (Art. 5(1)(a), (b)) - ongoing processing of former employees' or customers' data can't be justified
• Data minimisation (Art. 5(1)(c)) - orphaned accounts carry excessive, unnecessary permissions
• Storage limitation (Art. 5(1)(e)) - unused accounts push retention far past business need
• Integrity & confidentiality (Art. 5(1)(f), Art. 32)) - active credentials of departed users breach security "appropriate measures"

Both regulators and researchers directly link dormant accounts to real incidents:

• Microsoft's 2024 "Midnight Blizzard" incident began with a legacy non-production test account as an attack vector.^1balkan.id
• On average, organizations lose ~$23,000 per improperly offboarded employee; structured offboarding cuts post-departure costs by about 25%.^1balkan.id

To regulators, every orphaned account is:

• Unjustified processing
• A security vulnerability (Article 32)
• Evidence your erasure controls are ineffective

The SSO illusion: when 20% coverage looks like 100%

SSO helps, but it's not offboarding.

Most organizations:

• Disable identity in Okta/Entra
• Revoke VPN/email
• Assume access is gone

Here's the problem: SSO and SCIM touch only a slice of your stack.

Iden's data matches other vendors: ~20% of apps support SCIM or robust lifecycle APIs. The other 80%-long-tail SaaS, line-of-business tools, newly added apps-rely on manual provisioning.

So:

• SSO-only offboarding leaves swathes of accounts active
• Local admin accounts, direct logins, API keys remain
• Compliance can't demonstrate revoked access

Bringing SSO to fix manual offboarding is like bringing a knife to a gunfight-useful, but not sufficient.

What GDPR expects from offboarding in 2026

Regulators don't prescribe automation by mandate-they set clear outcomes. By 2026, those outcomes are unambiguous.

Right to erasure and storage limitation: offboarding as deletion trigger

The EDPB's 2026 report identifies persistent weak points:

• Defining proper retention per processing purpose
• Ensuring deletion across all systems and backups
• Proving deletion on demand (subject request or DPA)

Supervisory authorities have:

• Fined organizations for indefinite retention of customer and employee data^8cnil.fr
• Applied Article 5(1)(e) directly to employee log and metadata retention^{3dlapiper.com}

Offboarding is where these requirements become operational:

• Termination/contract end = access removal trigger
• That should launch deprovisioning and retention countdowns
• If accounts work weeks after leaver dates, your controls fail

Security of processing (Article 32): timing matters

DPAs and practitioners cite Article 32 when discussing offboarding timelines. A widely accepted benchmark: revoke access within 24 hours as "best practice" for ongoing system security.^9reddit.com

Practical expectations now:

• Core systems access (SSO, email, HR, finance, prod) cut immediately
• Remaining SaaS apps revoked automatically or promptly via reliable workflows
• All actions logged, reviewable, and mapped to the leaver event

Manual, ticket-based offboarding struggles on all counts-especially across 100-300 apps.

What auditors actually ask for

Across GDPR, SOC 2, ISO 27001, NIS2, and DORA, auditors look for:

• A list of all systems handling personal/critical data
• Documented offboarding procedures for each system type
• Evidence samples showing:
  • Termination date
  • Deprovisioning date/time by system
  • Who approved/executed the action
  • Completion logs or automation records

Recent erasure guidance stresses "policy-to-action alignment": regulators want proof your systems reliably perform deletion and access removal-not just document intent.^4isms.online

If your evidence is "spreadsheet plus Jira tickets," your GDPR posture depends on perfect manual execution-a losing bet in 2026.

Manual vs. SSO-only vs. complete IGA: Practical comparison

Assess your approach against what regulators expect:

If you're in the first two columns, you rely on "good intentions"-where regulators now expect provable controls.

Building automated offboarding for 2026 GDPR audits

Don't boil the ocean. Design for one termination event to drive complete, logged deprovisioning everywhere.

Technical controls to prioritize

1. Single source of truth

   • HRIS (employees) and vendor/partner management (contractors) must trigger offboarding-not just SSO disablement.

2. Lifecycle automation (joiner-mover-leaver)

   • Define for each identity:
     • Birthright provisioning on join
     • Access adjustment on move
     • Full deprovisioning on exit-including long-tail SaaS

3. Universal connectors (beyond SCIM)

   • Reach:
     • SCIM apps
     • API-enabled, non-SCIM apps
     • Apps without SCIM/APIs (browser-driven or RPA-style)

4. Time-bound, purpose-bound access

   • Employ just-in-time, time-boxed access for sensitive systems
   • Treat temporary access as its own data processing event

5. Immutable audit logs/reporting

   • Capture:
     • Departing user/account
     • Systems touched
     • Access removal timing
     • Failed/manual steps
   • Ensure logs can't be tampered with and meet audit/extraction needs

Evidence-driven offboarding in practice

A GDPR-resilient process allows instant answers to:

• "Who left in Q1? When was their access removed from Slack, Notion, Figma, GitHub, Jira, CRM?"
• "When a data subject requested erasure, were all related user roles/accounts revoked inside SLA?"
• "Which systems still granted access >24 hours post-leave? How was this fixed?"

Most organizations aren't there yet-but with enforcement rising, the window is closing.

How Iden closes the GDPR offboarding gap

Iden was designed for this: complete identity governance across your stack-faster, simpler, no compromises.

Where legacy IGA and SSO tools stop at SCIM, Iden extends coverage:

• Complete coverage: Connectors for SCIM, API-enabled, and non-API SaaS. Iden's catalog covers 175+ apps, including Slack, Notion, Figma, Linear, and others without SCIM.
• Zero-touch offboarding: HRIS/SSO termination triggers full deprovisioning in every mapped system.
• Fine-grained control: Remove not just apps, but channels, repos, projects-in a single, policy-driven workflow.
• Automated access reviews and evidence: Certifications and audit logs generate themselves-no more spreadsheet panic before audit week.

For GDPR, this means:

• Offboarding aligns with storage limitation and right to erasure-across all apps
• Immutable logs prove removal SLAs were met
• Meet multi-framework needs (GDPR, SOC 2, ISO 27001, NIS2, DORA, HIPAA) without point-solution sprawl

All without the legacy drag:

• Iden typically deploys in ~24 hours, versus 6+ months for legacy IGA.
• Customers see ~80% fewer manual access tickets and save ~120 hours per quarter on access reviews after automation.

In short: real-time, audit-grade offboarding-no IAM superteam required.

Actionable steps for IT, security, and compliance leaders

Facing 2026 regulatory reviews? Move quickly, decisively, and efficiently.

1. Run an offboarding reality check

Over the next month, pick 10 random leavers:

• What systems did they (actually) have?
• When was access revoked per system?
• Do you have logs-not just tickets-to prove it?

Any gap is now a GDPR and security risk-not just a workflow hiccup.

2. Map controls to GDPR articles

For each gap, link back to obligations:

• Orphaned SaaS with customer data -> Art. 5(1)(c), (e), (f); Art. 32
• Ex-employee in HR docs tools -> Art. 9 (special category), Art. 32
• No deletion evidence -> Art. 17; Art. 5(2)

This arms you for board/CFO conversations on investing in automation.

3. Prioritize universal coverage-not just "more SCIM"

Risk lives in the manual 80-90% of your stack-not the 10% with SCIM today.

Seek solutions that:

• Connect to any app-SCIM, API, or neither
• Allow single-policy expression across all targets
• Generate bank-grade, immutable logs for audits

4. Upgrade to real-time decisions-not "rubber-stamp" approvals

Manager mass-approvals no longer satisfy auditors.

Leverage automation and agentic workflows (AI-driven, autonomous workflows) to:

• Surface accounts left active post-exit
• Identify risk entitlements requiring time-boxing/removal
• Continuously reconcile HR, SSO, and app-level access

5. Pilot complete offboarding automation in a focused zone

No need to refit everything at once. Start where risk and complexity intersect:

• Engineering apps (GitHub, Jira, Notion, Linear)
• Sales stack (Salesforce, Outreach, Gong)

Measure:

• Termination-to-deprovisioning time
• Orphaned accounts found/removed
• Hours saved per offboarding
• Audit-readiness speed

Scale from there.

Frequently Asked Questions

How fast must we deprovision leavers to be "GDPR-compliant" in 2026?

GDPR doesn't mandate exact hours. Article 32 expects timely action, and regulators treat same-day or sub-24-hour deprovisioning as best practice.^9reddit.com If critical accounts linger for days post-termination, your "appropriate measures" may not hold up-especially following an incident or complaint.

Are orphaned accounts really a GDPR issue-or only security?

Both. Every orphaned account:

• Extends processing (data minimization, storage limitation)
• Increases unauthorized access risk (integrity/confidentiality)
• Blocks effective erasure and undermines accountability

Fines for unlawful retention and weak security are growing.^{3dlapiper.com} Orphaned accounts are the easiest way for authorities to demonstrate both failings.

Do we have to delete backup data when someone exercises their right to erasure?

Regulators acknowledge complete backup deletion isn't always possible. Authorities, including the ICO and EDPB, stress:

• Backups aren't for routine processing
• Retention limits must apply
• If backups are restored, erasure requests are re-applied^10reddit.com

You need documented, realistic processes-and to demonstrate primary systems are cleaned up. Automated offboarding is pivotal.

Is manual offboarding now banned by GDPR?

No article explicitly mandates automation. But GDPR does require:

• Appropriate technical/organizational measures (Art. 32)
• Storage limitation and erasure on demand (Art. 5(1)(e), Art. 17)
• Compliance demonstration (Art. 5(2))

Given increased breaches and regulatory focus, it's hard to defend manual, error-prone offboarding in 2026. Automation is rapidly becoming the standard for scale.

How does GDPR-grade offboarding help with NIS2, DORA, SOC 2, and others?

These frameworks demand:

• Timely, robust access control
• Evidence of actual, continuous control-not just documented processes
• Accountability for "who/what/when" of access

Automate and document offboarding, and you:

• Bolster GDPR erasure and storage limitation stories
• Strengthen NIS2/DORA access management and governance
• Make SOC 2/ISO 27001 audits easier-since the same evidence works everywhere^5mofo.com

Bottom line: One well-architected, audit-capable offboarding process lifts your entire compliance landscape.

If you're facing 2026 GDPR deadlines with a manual spreadsheet, treat offboarding as a protection liability-not just an ops headache. Teams moving to automated, complete IGA won't just avoid fines-they'll accelerate onboarding, cut SaaS waste, and approach every audit with confidence.