What you may keep

Start with the warning

If you take one thing from this module: do not start forwarding company documents to your personal email.

It feels protective. It feels like what a careful person would do. It is the single most common unforced error in this entire process, and it regularly turns a worker with a strong position into a worker with two problems.

Taking confidential or proprietary company material can breach your confidentiality agreement, violate trade secret law, and hand an employer a clean, independent reason to act that has nothing to do with your original dispute. It can also be used to argue that any later claim you bring is tainted. Courts have little patience for it.

The right instinct is correct. The method is wrong, and California gives you a better one.

---

What is clearly yours

These are your records, and keeping copies is normal and appropriate:

• Documents you signed. Offer letter, confidentiality and invention assignment agreement, arbitration agreement, equity award agreements, the separation agreement itself. Labor Code 432 specifically provides for copies of instruments you signed.
• Your pay records. Pay statements, W-2s, commission statements, expense reimbursements. Labor Code 226(b) gives you the right to inspect or receive copies.
• Your personnel file. Performance reviews, write-ups, your job description, policy acknowledgments you signed. Labor Code 1198.5 gives you access, within 30 calendar days of a written request.
• Your benefits records. Enrollment summaries, plan documents, 401(k) statements, equity statements.
• Emails you personally sent or received, where you are a party to the message and it is not confidential company information. This is the blurriest category, so be conservative.
• Anything already in your personal accounts. Texts, personal email, your own notes.

---

What is clearly not yours

• Customer and prospect lists
• Source code, designs, schematics, models
• Pricing, margin and financial data
• Internal strategy documents, board material, roadmaps
• Other people’s personnel data, compensation or medical information
• Anything marked confidential, proprietary or attorney-client privileged
• Databases, exports or bulk downloads of any kind

A good filter: would this document matter to the company if a competitor had it? If yes, leave it.

---

The lawful way to get what you need

California gives you three statutory hooks, and one letter can use all three.

What you want	Statute	Employer’s deadline	Penalty for failure
A copy of anything you signed	Labor Code 432	On request	No separate penalty
Payroll records	Labor Code 226(b), (c)	21 calendar days	$750 under 226(f)
Personnel file	Labor Code 1198.5(b)	30 calendar days	$750 under 1198.5(k)

Two practical notes. Former employees are generally limited to one personnel file request per year under Labor Code 1198.5(d), so make it complete the first time. And a claim for failure to provide records has a one-year filing deadline at the Labor Commissioner, which is shorter than most wage claims.

The ready-to-send letter is in Tools.

---

The self-help trap, in the cases

The warning at the top of this module has case law behind it, and the cases draw the boundary more precisely than “do not take things.”

Using your access for the wrong purpose is not, by itself, federal hacking. In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court held that a person who is entitled to access a computer system does not “exceed authorized access” under the Computer Fraud and Abuse Act merely by using information they could legitimately reach for an improper purpose. The test is gates up or gates down: liability turns on reaching areas that were off limits to you, not on breaking a workplace policy about why you looked. The Third Circuit applied the same rule to employees in NRA Group, LLC v. Durenleau, No. 24-1123 (3d Cir. 2025), holding that breaches of computer use policies, without code-based hacking, do not state a CFAA claim. Note the limit: a petition for Supreme Court review of that decision was filed in February 2026 and was pending at the time of writing, so the ruling is current but not final. And access that continues after your authorization has been revoked, once you have left, is a different situation entirely.

Trade secret law carries the most exposure. The Defend Trade Secrets Act has a whistleblower immunity provision, 18 U.S.C. 1833(b), but it is narrow by design. It protects a disclosure made in confidence to a government official or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law, or a disclosure made under seal in a court filing. Bulk taking fits none of those categories. In Unum Group v. Loftus, 220 F. Supp. 3d 143 (D. Mass. 2016), an employee filmed removing boxes of documents argued immunity; the court rejected the defense at the pleading stage because he had filed no whistleblower action and had not shown the taking was solely for the protected purpose, and ordered the documents returned.

So the lawful protocol, if you hold evidence of actual wrongdoing, is specific:

• Send it to one place: a government agency, or your own attorney, in confidence, for the purpose of reporting or investigating the suspected violation. That is the channel 1833(b) protects.
• Do not send it to your personal email, your personal cloud drive, a journalist, or a group chat. Each of those moves the same documents outside the immunity.
• For everything else, keep a private log instead of the documents themselves: dates, times, who was present, exact quotes where you can manage them, and the file names, senders and subject lines of the messages that matter. A lawyer can compel the originals later through discovery. The log is yours, it lives on your own device, and nobody can call it theft.
• Use the statutory route in the table above for your own records. A Labor Code 1198.5 request for your personnel file is not a favour. It is a right with a deadline and a penalty attached, and what it produces arrives with the employer’s own stamp on it.

---

Handing back the devices

At some point in the first week, the company will want its property back, and the agreement may ask for much more than the laptop. A typical demand has four parts: return every device and record immediately, permanently delete all company information from your personal devices, accounts, cloud storage and backups, authorise the company to access, inspect, image and wipe any device you used for company business, and certify that no copies have been retained anywhere.

The return itself is legitimate. Company property is company property, and keeping company trade secrets, customer data or confidential files is exactly the conduct the section above warns against. This protocol is not about keeping any of that. It is about the fact that the same phone, tablet or laptop often also holds your personal photographs, messages, contacts, tax files and medical records, and that a blanket wipe or inspection reaches those too. Treat the asks below as negotiation guidance, not a rule of law: no California authority makes a broad device clause unlawful by itself, but preservation duties are real, and the wording you agree to is the wording you will be held to.

Before you hand anything over, ask for the protocol in writing. What is being returned, to whom, by when, and what happens to it next. A handoff with a named recipient and an appointment is a process. “Leave it with security today” is not.

Export your personal data first. Before the return date, copy your own personal material off company devices: photographs, personal contacts, personal files, anything that is yours and not the company’s. Do this openly and within the time the employer allows. If the timeline makes it impossible, say so in writing and ask for a supervised session to do it.

Get a written receipt. When you hand over each device, get a receipt or a confirming email listing what was returned and its condition, and later, written confirmation of what the company wiped and when. If anything is later said to be missing, that receipt is the record.

Narrow the certification. An absolute statement that no copies exist anywhere is a promise most people cannot honestly make: backups, synced folders and old email accounts keep copies their owners have forgotten. Offer the accurate version instead, that after a documented search of the places you list, you have deleted the company information you found and retained none knowingly. A certification tied to reasonable knowledge after a real search protects the employer nearly as well and does not ask you to swear to the contents of every backup you have ever made.

Do not agree to open-ended imaging of a personal device. Unrestricted inspection of a phone you own reaches years of private life that has nothing to do with the company. Propose a segregated process instead: you delete the identified categories of company data and document where you searched, or a neutral process scoped to company material only.

Stop if a hold is in play. If you have received a litigation hold, or a claim is reasonably anticipated, do not wipe, reset or delete anything that might be relevant, including material on your own devices, until you have taken advice. Deleting under a hold can be spoliation, and it can do more damage to your position than the data would have. Tell the employer, in writing, that preservation duties are why you are pausing, and let the lawyers work out a protocol that satisfies both duties.

---

Preserving what you already have

Preservation is about completeness and integrity, not quantity.

Keep originals, not retypings. A forwarded email loses header information. A screenshot loses everything underneath. Where you can, export the original file.

Keep email as email. If you have messages in a personal account, leave them there and export them in a format that preserves headers, such as .eml or a full mailbox export. Headers carry timestamps and routing information that a screenshot does not.

Do not edit files. Do not re-save, rename extensions, or open and re-export PDFs. Every one of those operations changes the file’s internal metadata and can undermine its value later. Make a copy and work from the copy.

Write a contemporaneous timeline. Dates, who said what, what you received and when. Write it now rather than from memory in a year. Keep it factual, keep it dated, and keep it in a personal file. A plain, unemotional chronology is far more useful than you would expect.

Organize by date. One folder, files named YYYY-MM-DD description. Resist the urge to build a case file. Build a record.

---

On recording conversations

California is an all-party consent state. Under Penal Code 632, recording a confidential communication without the consent of all parties is a crime, and such a recording is generally inadmissible. Do not record your exit meeting secretly.

What you can do instead: take contemporaneous notes, and send a short, neutral confirming email afterward. “Thanks for meeting today. To confirm my understanding: my separation date is X, final pay will be issued on Y, and benefits end on Z.” That email is dated, lawful, and often more useful than a recording would have been.

---

What good preservation looks like

A complete, boring folder:

2026-03-14 performance review.pdf
2026-04-02 separation meeting notes.md
2026-04-02 separation agreement v1.pdf
2026-04-04 separation agreement v2.pdf
2026-04-04 email - revised agreement.eml
2026-04-08 executed agreement.pdf
2026-04-08 certificate of completion.pdf
2026-04-09 final pay statement.pdf
2026-04-10 records request sent.pdf
timeline.md

That folder answers almost every question anyone will ever ask you about this, and nothing in it required taking anything that was not yours.