What Should Happen to ID Cards When Staff Leave?

When an employee leaves, their ID card should be returned on their last day, deactivated on every system it can open, recorded as recovered, and then securely destroyed. That sounds simple, yet in our experience, the leaver stage is the part of the card lifecycle most often left to chance.

Most businesses put real effort into issuing cards; organising photographs, branding, access levels and branded lanyards. Far fewer have a written process for getting those cards back. A card that walks out of the door with a former employee still carries your logo, their photo and, very often, working access to a building.

This guide sets out what should happen to ID cards when staff leave, why it matters for security and data protection, and how to build a leaver process that actually gets followed.

Why Unreturned ID Cards Are a Real Risk

An ID card is not just a badge. Depending on how it was produced, it can be a door key, a proof of identity, a payment token for lunch, or a login pass for printers and PCs. Each of those functions creates a different risk once the holder no longer works for you.

Unauthorised physical access

If a proximity or smart card is not deactivated in your access control system, it will keep opening doors. This is the most serious and most common failure we see, particularly where HR and facilities teams use separate systems, and nobody owns the final step.

Impersonation and social engineering

Even a card with no chip can be misused. A branded photo ID worn on a lanyard is a strong visual signal that someone belongs. Reception staff, contractors and visiting suppliers are unlikely to challenge a person wearing a genuine company card, which makes old cards useful for tailgating.

Data protection obligations

An ID card holds personal data; it includes a name, a photograph and often a job title or employee number. Under UK GDPR, organisations must keep personal data secure and must not keep it for longer than necessary. A clear process for recovering and destroying cards helps you show that you take both principles seriously.

Audit and compliance gaps

If your organisation works to ISO/IEC 27001, the standard expects assets such as access cards to be returned when employment ends. Auditors will often ask to see evidence of this, so an untracked card can become a nonconformity as well as a security gap.

A Step-by-Step Leaver Process for ID Cards

The most reliable leaver processes are short, written down, and owned by a named person.

Step 1: Flag the card when notice is given

As soon as HR records a leaving date, the cardholder's record should be flagged. This gives facilities or security time to plan deactivation and avoids a last-minute scramble on the final afternoon.

Step 2: Collect the card in person on the last day

Add card return to the exit checklist alongside laptops, keys and parking permits. Ideally, the line manager or HR collects it face to face during the exit meeting, rather than relying on the leaver to hand it in at reception.

Step 3: Deactivate access at the point of collection

Deactivate the card in your access control system as soon as it is handed over, not at the end of the week. For staff leaving on bad terms or in sensitive roles, revoke access before the exit meeting begins and escort them as needed.

Step 4: Remove linked permissions

Many cards do more than open doors. Check whether the card is also used for secure print release, cashless catering, lockers, car park barriers or logical access to PCs, and remove it from each system.

Step 5: Record the return

Log the card number, date of return, who collected it, and who deactivated it. A simple card register, whether a spreadsheet or a module in your access control software, gives you an audit trail and makes it easy to spot cards that were never recovered.

Step 6: Store returned cards securely until destruction

Returned cards should go into a locked box or cabinet, not a desk drawer. Batch them for secure destruction regularly.

Should You Reuse or Destroy Returned ID Cards?

For printed photo ID cards, destroy them. Reissuing a card printed with someone else's name and photo is never appropriate, and cutting a card in half with scissors still leaves the photo, name, and chip largely intact.

Secure destruction

Use a crosscut shredder rated for plastic cards, or a professional destruction service that issues a certificate of destruction. Recognised standards such as DIN 66399 give shredding security levels for different types of data carriers, which is useful when you need to evidence your method to an auditor. Make sure the embedded chip or magnetic stripe is physically destroyed, not just the printed surface.

When reuse can make sense

Blank, unprinted access cards or generic visitor and contractor passes can sometimes be reissued after being wiped and re-encoded in your access control system. If you plan to do this, keep reusable stock separate from personalised cards, and record each reissue in your card register.

Thinking about sustainability

Most ID cards are made from PVC, which is difficult to recycle through household waste streams. Consider using recycled PVC, PET-G or bio-based card materials for future card runs, and ask your destruction provider how shredded material is handled.

What to Do When an ID Card Is Not Returned

Sometimes a card is lost, forgotten, or simply not handed back, especially when someone leaves suddenly or works remotely. The priority is to make the card useless, then try to recover it.

Deactivate immediately

Treat an unreturned card exactly like a lost card. Deactivate it on every system straight away and mark it as unrecovered in your card register.

Request its return in writing

Contact the former employee and ask them to return the card, ideally with a prepaid envelope. Keep a copy of the request on file as evidence that you took reasonable steps.

Brief front of house teams

If there is any concern about the circumstances of the departure, let reception and security staff know that the person no longer works for you. A deactivated card can still be worn and shown, so people need to know not to rely on it.

Check your contracts and handbook

Your employee handbook should state that ID cards remain company property and must be returned when employment ends. Some organisations also include this in contracts of employment. Take advice from HR before making any deductions from final pay for unreturned items.

Building an ID Card Lifecycle Policy

The leaver stage works best when it is part of a wider ID card policy that covers issue, use, replacement and return. A one-page policy is usually enough for small and medium organisations.

What the policy should cover

A good ID card policy explains who is responsible for issuing and deactivating cards, that cards remain company property, how lost cards must be reported, and what happens when someone leaves. It should also say how long card records and photographs are kept after a person leaves, in line with your data retention schedule.

Contractors, temps and agency staff

Short-term workers are where most gaps appear. Give temporary staff cards with a printed expiry date and, where your access control system allows it, set the access to expire automatically on the same date. That way access ends even if nobody remembers to collect the card.

Design choices that help

Card design can support your leaver process. Colour-coded cards for staff, contractors and visitors make it easier to spot the wrong card in the wrong place. Printed expiry dates, holographic overlays and visual security features make old or tampered cards easier to identify quickly.

Review it regularly

Run a reconciliation at least once a year, comparing active cards in your access control system against your current staff list. Any active card belonging to a former employee is a sign that a step in the process is being missed.

Can an employee keep their ID card as a memento?

It is best not to allow this. Even a deactivated card can be used to impersonate staff. If someone asks to keep a memento, a printed photo or a non-functional commemorative card without your branding is a safer option.

How quickly should a leaver's card be deactivated?

On the same day the card is returned, and no later than the end of their final working day. For sensitive roles or difficult departures, deactivate before the exit meeting.

Is it enough to cut an ID card in half?

No. Cutting a card in half often leaves the name, photo, and chip readable. Use a card shredder or a certified destruction service.

How long should we keep a leaver's ID photo and card record?

Only as long as you have a genuine need, as set out in your data retention policy. Many organisations keep the card register entry for audit purposes but delete the photograph once the person has left. Check your approach with your data protection lead.

Who should own the leaver process for ID cards?

One named role should own it end to end, usually HR, facilities or security. Shared ownership without a clear lead is the most common reason cards slip through.

Make Card Returns Part of Every Exit

When staff leave, their ID card should be collected, deactivated, recorded and destroyed, in that order and on their last day. Building those four steps into your exit checklist closes one of the simplest security gaps in any workplace.

At ID Card Centre, we help organisations across the UK design and print secure ID cards, choose the right card printers and set up card management processes that work in practice. If you are reviewing your ID card policy or planning a new card run with expiry dates, colour coding or visual security features, contact our team for practical, no-obligation advice.