AI Avatar Offboarding: A Practical Exit Checklist

Start an avatar offboarding review when a team member leaves or asks you to stop using their face or voice. First check which rights and permissions are still in place. Then map new renders, live content, backups and copies held by other firms. This guide gives you a register to track each decision. Keep permission to use a likeness separate from the lawful basis for handling personal data.

This article is general information, not legal advice. Check with a qualified adviser for your situation.

Why Offboarding Needs Its Own Workflow

A departing employee may have appeared in training videos, social ads, or welcome messages. Their face and voice may live in many places. Some of those places are easy to find. Others are not.

Offboarding is not one big delete button. It is a series of small, recorded decisions. Each asset needs an owner, an action, and a due date. Some assets stop being used immediately. Others stay for legal or technical reasons. The key is knowing which is which.

Two Separate Questions

People often mix up two ideas. The first is: do we have permission to use this person's likeness? That is a question about image rights, contracts, and consent to appear. The second is: what is our lawful basis for processing personal data? That is a data protection question.

The UK Information Commissioner's Office (ICO) explains that consent for data processing requires genuine choice and control. A power imbalance can make consent inappropriate, including in employment relationships. See ICO guidance on when consent is appropriate. But that is about data processing. It is not the same issue as permission to use a likeness. Keep the two tracks separate in your register.

The Stop-Use Principle

When someone asks you to stop using their likeness, pause new use while you check the request and its scope. Record exactly what the person asked. Leaving a job does not, by itself, withdraw consent or end all rights to use past work. Do not mark consent as withdrawn unless it was.

Existing published material may need a different decision. You might remove it, replace it, or keep it for a defined period. The decision depends on the contract, the context, and the risk.

Kyndrify's current responsible AI policy states that withdrawn or expired consent blocks new rendering of real-person Digital Twins. See Kyndrify responsible AI policy. That is a useful control, but it does not solve everything. Existing outputs still need review.

The Offboarding Workflow

Here is a proposed workflow in six steps. Adapt it to your tools and team size.

Step 1: Trigger and Scope

Start with a clear trigger. Examples: resignation letter, contract end, or a written withdrawal of likeness permission. Record the date and the exact scope. Does the person withdraw all use, or only certain channels? A narrow withdrawal needs a narrow response.

Create a register entry. List every known asset type: avatar renders, video clips, still images, voice samples, campaign copy, and training materials. Do not guess. Ask the people who made the assets.

Step 2: Pause New Renders

Use an approved way to disable the avatar or block new renders while you check the request. Do not change the consent record to show a withdrawal that did not happen. If the tool lacks a pause control, restrict access and give creators a clear do-not-use notice. Keep consent evidence itself restricted to staff who need it.

A pause is a team decision during review. It is not a claim that the tool supports consent limits by channel.

Step 3: Inventory Existing Assets

Now find what already exists. Check these places:

• Active campaigns and ads
• Website pages and landing pages
• Social media posts and profiles
• Email templates and sequences
• Internal training videos
• Sales decks and proposals
• Third-party platforms and partner sites

For each asset, record the location, the owner, and the format. A simple table works well. You will use it for the rest of the workflow.

Step 4: Decide Per Asset

Do not apply one rule to everything. For each asset, choose one of these actions:

• Remove now: delete or unpublish immediately.
• Replace: swap the avatar for another person or a synthetic voice.
• Keep with review date: keep for a defined reason, with a named owner and a review date.
• Keep for legal retention: keep only where a legal duty or another justified basis requires it, and limit access.

The ICO's storage limitation principle says personal data should not be held longer than needed for the purpose. Retention must be justified and reviewed. Legal duties can justify keeping some records, but they are not the only possible basis. See ICO storage limitation guidance. That means you should not promise immediate deletion of all backups or consent evidence. Instead, you justify what you keep and for how long.

Step 5: Third-Party Copies

Your own systems are only half the story. Other firms may hold copies. Agencies, ad platforms, video hosts, and partners may all have the asset. Send a clear instruction to each one. Ask them to confirm the action they took. Record that confirmation in your register.

Do not assume a platform deletes something just because you removed it from your account. Check the platform's own rules. Some keep cached copies for a short time. Others need a manual request.

Step 6: Evidence and Review

Keep a short record of what you did and why. It shows your team's actions, but does not prove lawful use or a complete response. Keep any required evidence under the right access controls.

Set a review date for any asset you kept. When that date arrives, check again. Has the reason for keeping it changed? If so, act.

Worked Example: Team A's Departing Trainer

Let's follow a fictional small business. Team A runs a chain of three fitness studios. They use AI avatars for member welcome videos and social media ads.

Trigger: Priya, a senior trainer, resigns. Her last day is 30 June. Her contract includes a written release stating that her likeness may be used in member welcome videos and social media ads for 12 months after departure, unless she withdraws permission earlier. On 2 July, she emails to withdraw permission for new social media ads. She does not object to existing member welcome videos staying until the end of the year.

Scope: The withdrawal covers new social ads only. Existing welcome videos may stay until 31 December under the written release. The register records both points.

Freeze: Team A's content manager pauses Priya's avatar status in their platform while they confirm the scope of her email against the contract. They add her name to a shared blocklist. No new renders can use her likeness while the pause is in place.

Inventory: The team finds four assets:

1. A welcome video on the member portal (active)
2. A social ad running on two platforms (active)
3. A still image in a summer campaign (draft, not yet published)
4. A training video for new staff (internal)

Decisions:

• Welcome video: keep until 31 December, then replace. The written release covers this use. Owner: member experience lead.
• Social ad: remove now from both platforms as a voluntary business choice. The stated withdrawal concerned new ads, so Team A records this wider step separately. Owner: marketing manager.
• Still image: do not publish. Delete the draft. Owner: marketing manager.
• Training video: pause access until the team confirms that internal use is allowed. Do not infer permission from Priya's silence. Owner: operations lead.

Third parties: The marketing manager emails both ad platforms. Each confirms removal. The confirmations are saved in the register. In this fictional example, both platforms confirm within 48 hours; that timeline is illustrative, not a standard you should rely on.

Evidence: The register shows the trigger email, the scope, the pause action, the inventory, the decisions, and the platform confirmations. The review date for the welcome video is 31 December.

This example shows a narrow withdrawal handled with a clear process. Not everything was deleted. Each kept asset had a reason and an owner.

Handover Register Template

Use this table for every offboarding. Add rows as needed.

Asset	Location	Owner	Action	Evidence	Due date	Status
Welcome video	Member portal	Member experience lead	Keep until 31 Dec, then replace	Written release clause noted	31 Dec	Open
Social ad	Platform A, Platform B	Marketing manager	Remove now	Platform confirmation emails	3 July	Done
Draft still image	Design folder	Marketing manager	Delete, do not publish	Deletion screenshot	3 July	Done
Training video	Internal LMS	Operations lead	Pause access; confirm permission before reuse	Rights review pending	3 Jan	Open
Consent record	HR drive	HR lead	Keep for legal retention	Retention policy reference	Annual review	Open

Edge Cases to Consider

The person asks for full deletion of everything. You may not be able to promise that. Backups and legal records may need to stay for a defined period. Explain what you can do, what you will keep, and why. The ICO's storage limitation principle supports justified retention, but it does not require immediate deletion of all copies. See ICO storage limitation guidance.

The person never gave written permission. Pause new use immediately. Then review existing assets. The lack of a signed release does not automatically mean you must delete everything, but it raises the risk. Get advice before continuing any use.

The avatar appears in a group scene. Removing one person may mean re-rendering the whole scene. Record the cost and the timeline. Blurring may not remove a recognizable voice or other identifying features, so consider replacement or removal of the asset, with an appropriate rights review.

A third party refuses to confirm removal. Escalate within your own team. Keep a record of your requests. If the asset remains live, consider whether you need to stop working with that third party.

The person is a contractor, not an employee. The same workflow applies. The contract terms may differ, but the pause-and-verify principle is the same.

Three Short FAQs

Do I have to delete everything when someone leaves?

No. Departure alone is not a withdrawal of consent, and it does not automatically end all usage rights. You should pause new use while you verify the actual scope and authority, then review existing assets. Some assets may stay for legal or contractual reasons. The key is a recorded decision with a review date.

Is consent for data protection the same as permission to use a likeness?

No. The ICO treats consent for data processing as one issue. Permission to use a likeness is a separate contractual or image-rights issue. See ICO guidance on when consent is appropriate. Keep both tracks in your register.

What if I cannot find all the assets?

Do your best with a structured search. Record what you checked and what you found. Set a reminder to re-check in 30 days. Keep unresolved items open and assign someone to follow up.

Useful Context

If you are new to consent for AI avatars, start with what consent first means for our brand. If you want to understand privacy trade-offs before using AI video, read is AI video privacy friendly. For HR teams considering avatars for internal use, see AI video for HR teams.

Next Action

Open a blank register today. Add one row for every current employee or contractor whose likeness appears in your content. That single list is your starting point. When the next offboarding happens, you will already know where to look.