Documents and version control
An access revocation checklist for after your event
The event finished a month ago, and a former supplier can still open the speaker folder.
Opens WhatsApp with a draft you can edit before sending. Nothing is sent automatically.
The short answer
Revoke access in a planned order: list who has access, end external access first, then volunteers and committee roles that are no longer needed, and record each removal with a date.
Do it on a scheduled date after final payments and handover, not from memory.
Start from the access list
Use your file access matrix as the list of who has what. Add anything not in it: shared mailboxes, registration tools, survey forms, messaging groups, shared calendar entries and any accounts opened for the event.
If you cannot find a list, check the sharing settings of each folder and tool and build the list from what you see.
Choose the right moment
- External suppliers: after their final deliverable is accepted and the final invoice question is closed.
- Volunteers and temporary staff: when their last shift ends.
- Committee members: at the handover to the next committee or when they leave their role.
- Anyone leaving mid-project: the day their role ends, after file ownership has moved.
Revoke in order
- Take back anything that gives wider reach first: owner or share rights, then edit, then comment, then view.
- Close shared links that allow anyone with the link to open a file.
- Remove accounts or seats opened for the event in each tool.
- Remove people from messaging groups and shared calendars.
- Check that no file remains owned by a person who has gone.
What to keep
Keep the files the organisation needs for handover and records. Remove only access, not the files, unless you have confirmed deletion with the right person.
How long to keep files and personal data, and when to delete them, is a question for your data protection contact and any contract terms. Ask before you delete anything.
Record it
Log each removal with the date, the person who did it and the person whose access ended. Pass the record into the handover pack so the next organiser can see what was closed.
Worked example · Fictional example
Closing access six weeks after a seminar
Fictional organisation and figures, for illustration only.
A fictional property institute ran a one-day seminar for about 150 members. At closure, the secretariat reviews its list and finds the registration supplier, the photographer and two former volunteers still have access, and one survey form link is open to anyone.
The secretariat revokes the supplier and photographer first, after the final invoice is settled, closes the survey link, removes the volunteers and logs six removals with dates. It asks the data protection contact whether the registration export may remain in the archive folder and for how long.
Use this yourself
Access revocation checklist
Work through this after final payments and handover. Record the date and the person for each line.
- List of everyone with access built from the matrix and tool settings.
- Final deliverables accepted and invoice questions closed for each supplier.
- Supplier access removed, in order: owner/share, edit, comment, view.
- Open sharing links closed.
- Event-specific accounts, seats and forms closed or archived.
- Volunteers and temporary staff removed.
- Messaging groups and shared calendars cleaned.
- No file left owned by a departed person.
- Files needed for records and handover kept; retention and deletion questions sent to the data protection contact.
- Removal log completed and added to the handover pack.
Open the tool: Conference materials and translation-version checker
Handle it in-house, or bring in help?
Your team can usually handle this when
- The secretariat controls the folders and tools and can review the list in an hour.
- Few suppliers and no personal data beyond contact details.
Outside planning help earns its fee when
- Many tools and suppliers, and no one remembers what was opened for the event.
- Personal data is spread over several systems and the team is unsure what to keep or delete.
Want the close-down run for you?
A conference project lead can build the access list, schedule each removal after supplier sign-off, keep the removal log and add it to the handover pack. Retention and deletion decisions go to your data protection contact.
Questions organisers ask
Should we delete the files when access ends?
No. Remove access first. Deleting files is a separate decision, to be checked with your data protection contact and any contract terms.
When should supplier access end?
After the final deliverable is accepted and payment questions are closed. Put the end date in the matrix when you first grant access.
How do we find forgotten access?
Check each tool's sharing and user settings, shared links, mailing groups and calendars, and ask each supplier to list what they were given.
Related resources
Content record: Draft. Written from the cited sources and checked by automated rules; not yet independently reviewed.