Field note
Leavers, shared passwords, and the admin seat that never closed
· Priya Nair
The three patterns
A person left three months ago and still owns records, sometimes still has a login. A ‘team’ password was created for a contractor and never rotated. An operations lead was granted modify-all during a data fix and remains an admin because nobody wants to be the person who breaks a report.
We list them with evidence: last login, last export, which objects they can delete. The tone is practical. The recipient is usually IT plus the commercial owner of the CRM.
PDPA is in the room
Customer contact data sitting in a Malaysian CRM is personal data. If you cannot say who can export it, you will have a hard time explaining a request or an incident. We are not your lawyers. We can show you the permission screen and the leavers who are still in it.