If you represent employers long enough, you will see this movie more than once.

A key employee resigns. Or is terminated. Or becomes incapacitated. Or passes away.

And suddenly nobody can access the payroll portal, the marketing ad account, the benefits dashboard, the recruiting platform, the domain registrar, or the email inbox that holds every vendor relationship since 2018. Often the account sits in that person’s own name, tied to a personal email or a personal cell phone that gets the login codes. 

Cue the panic. Then the scrambling. Then the expensive cleanup.

This is the part where someone says, “Can’t IT just get in?”

Sometimes, yes. Sometimes, absolutely not. And sometimes “trying” creates a legal mess you did not budget for.  It depends on who owns the account, what the platform’s terms say, and who has the legal right to consent. Federal law, state computer crime laws, and the platform’s own rules can all apply. If the employee has died and the account is in their name, access may even run through their estate rather than their business. 

Also, if you have EU connections, be three times as afraid. 

Why “digital estate planning” matters to employers

Estate lawyers talk about “digital assets” as electronic records in which someone has a right or interest. Think email, social media, cloud files, and online accounts. The uniform law that many states use as a framework is the Revised Uniform Fiduciary Access to Digital Assets Act, published in 2015. It lets an executor, agent, or trustee get into a person’s accounts after that person dies or becomes incapacitated.

Here is the employer twist that gets overlooked:

Wyoming law explicitly says this fiduciary access framework does not apply to an employer’s digital assets when an employee uses them in the ordinary course of business. Most states that adopted the uniform act have the same rule. That includes Texas, North Carolina, and Colorado. Colorado even goes a step further and also leaves out accounts that owners and managers use to run the company. In other words, do not expect an estate planning statute to magically fix your access problem when the person who set up the accounts is gone. And if the employee opened the account in their own name, the statute may help their estate, not your business. One more wrinkle: the state that usually matters is where the employee lived, not where your business is. 

That one line is a warning label for every employer: treat business access like business continuity, not like a family scavenger hunt.

Terms of service are not vibes. They are rules.

Most online accounts are governed by terms of service, and those terms often do three annoying things:

1. They forbid password sharing and account transfers.

Some platforms prohibit sharing passwords, giving others access to personal accounts, or transferring accounts without permission. Meta’s terms, for example, say this almost word for word.

2. They treat accounts as personal, not portable.

An account established under an employee’s personal credentials may not be transferable simply because the employer used it for business purposes. That is why whose name and email go on the account matters from day one. 

3. They reward planning and punish improvising.

This matters most for accounts in an employee’s own name, since the act does not cover employer accounts. Under the Revised Uniform Fiduciary Access to Digital Assets Act framework, when a platform offers a qualifying online tool for post-death access instructions, those instructions generally take priority over conflicting directions in a will or similar record. Think Google’s Inactive Account Manager or Facebook’s legacy contact. If no one used a tool or left directions, the platform’s terms usually decide.

Employer translation: the platform’s built-in admin and legacy tools matter. For business accounts, that means company admin access: a second admin on every account, business manager accounts for social media and ads, and a company email on every login. Your internal policy is still essential, but you need both.

The legal risk employers accidentally step into

Two federal laws show up in the background of a lot of “just log in and grab the files” conversations:

Computer Fraud and Abuse Act

This federal statute addresses “fraud and related activity in connection with computers.”

Even when you are convinced you are doing the “right” thing for the business, accessing an account without authorization can create legal risk, depending on the facts. Whether access violates the statute requires more than simply showing that someone broke an internal policy or a platform rule.

Stored Communications Act

This law limits when certain service providers can disclose the contents of communications. As a baseline, covered providers generally cannot disclose stored communications except under specified circumstances.

One key exception permits disclosure with the lawful consent of the originator, an addressee, an intended recipient, or, for certain remote computing services, the subscriber.

Practical takeaway for HR and operations: do not build your business workflow around personal accounts, personal devices, or “we all know the password.” Build it around company-controlled accounts, documented authority, and provider tools that respect consent and ownership.

The Fix: a Digital Continuity Plan that helps prevent expensive fires

This is not just “compliance.” It is uptime.

A clean digital continuity plan can help prevent payroll delays, marketing shutdowns, lost sales leads, and ugly internal disputes. It also helps you move faster in growth phases because access and ownership are already structured.

Here is a simple framework for employers:

1. Inventory what you actually have

Not someday. Now.

List every account that runs revenue, payroll, benefits, recruiting, customer communications, banking operations, and core tech.

2. Decide who owns what

Company-owned accounts should be tied to company-controlled email domains, not personal Gmail accounts.

Make sure vendor accounts reflect business ownership and allow multiple admins.

3. Use the provider’s tools instead of “password folklore”

For individuals, some providers offer tools for managing access or directing what happens to account data after death or inactivity.

Employer version: use business admin consoles, shared ownership models, and role-based access that survives turnover.

4. Write the off-boarding checklist like you mean it

Disable access, transfer ownership, rotate credentials, and preserve records you have to keep. Then document it.

5. Practice the “hit by a bus” scenario

If one person disappears tomorrow, can you still run payroll, invoicing, customer support, and sales? If the answer is “maybe,” you have a profit leak.

Wyoming-specific note you can steal for your next leadership meeting

Wyoming’s statute explicitly carves employer digital assets out of the fiduciary access framework when employees used those assets in the ordinary course of business.

That is your permission slip to stop treating this like a personal estate planning problem and start treating it like what it is: operational control.

Employer Digital Asset Continuity Checklist

A practical checklist for HR, operations, and leadership to help prevent account lockouts, data loss, and revenue interruptions when employees leave, become unavailable, or change roles.

A. Inventory and ownership

• Make a master list of business-critical accounts, including email, payroll, benefits, banking, domain registration, cloud infrastructure, social media, advertising, customer support, CRM, and accounting systems.
• Confirm each account is registered to a company-controlled email address where the provider permits it.
• Confirm at least two administrators exist for each critical platform, where supported.
• Confirm vendor contracts identify the company as the customer and clarify account ownership and access rights.

B. Access governance

• Use role-based access, not shared passwords.
• Require multi-factor authentication for admin roles.
• Maintain a secure “break-glass” admin method with documented controls.
• Document who can approve access changes and how quickly.

C. Off-boarding and role-change protocol

• Disable or modify access at the appropriate time during separation, consistent with applicable preservation obligations.
• Transfer ownership of accounts, pages, ad accounts, and shared drives.
• Rotate credentials and revoke tokens.
• Preserve business records that must be retained.
• Document each step, including who performed it and when.

D. Death or incapacity protocol

• Identify who has authority to act for the company.
• Identify applicable provider processes and required documentation.
• Do not assume you can obtain passwords from providers.
• Use provider tools when available.
• Engage counsel before accessing personal accounts or private communications.

E. Litigation readiness

• Map where business communications live.
• Establish a process for preserving relevant data while accounting for provider terms, privacy requirements, and applicable legal holds.
• Confirm that your policies cover business email, device use, and records retention.

FAQ for HR and business owners

Can we just use the employee’s password to get in?

Many platform terms prohibit password sharing or account transfers, and providers may restrict access under their terms. Separately, “just logging in” can create legal risk depending on the account, authorization, consent, and facts. Access to a company-controlled account is not necessarily treated the same as access to an employee’s personal account. Consult counsel before accessing an employee’s personal account.

Can a provider hand us the contents of messages?

Service providers have restrictions on disclosing content, with specific exceptions such as lawful consent. Whether an exception applies depends on the circumstances.

What should we do first if we know we have a single point of failure?

Pick the top five revenue and payroll systems, establish a second authorized administrator where supported, and move ownership to company-controlled credentials through the provider’s approved process.

Call to action

If one employee leaving could lock your business out of critical accounts, it may be worth taking a closer look at your access policies and off-boarding procedures.

If you want, Treaty Oak Employers’ Law Group helps employers address workplace policies, employee transitions, and the legal risks that come with managing humans.