Delete a user with data on hold

You can delete a Google Workspace account only if it's not on hold. An admin with Vault privileges (Manage Holds, View All Matters, and Manage Audits) can release an account from account-based holds. An admin with user management privileges can remove an account from organizational units that are on hold. Learn more about Vault admin privileges.

The following instructions include steps in Vault and in your Google Workspace admin console.

After you delete an account, you can recover it within 20 days. However, account data that was marked for deletion is no longer protected by retention rules or holds and can be purged. This data can't be recovered, even when you restore the account.

1. Review the account with your legal team to determine if the user’s data must be preserved with a hold.
2. If their data must stay on hold, you have a few options:
   • Switch the user to an Archived User license, which preserves their Google Workspace data in Google storage. With this option, you don’t delete the account. For instructions, see Manage former employees and their data.
   • Export the user’s data and preserve it outside Google Workspace, then continue to the next step to release the hold and delete the account. For instructions, see Export data from Vault.
3. If their data can be deleted, sign in to vault.google.com.
4. Click Reports.
5. Release the user from any account-based holds:
   1. Click User Holds.
   2. In the search bar, enter the account.
   3. Find the account. If the account isn’t listed, that means it isn’t under an account-based hold and you can go on to the next step.
   4. Click the row with the account. A panel opens that lists the account-based holds that include the account.
   5. Click each hold and release the account from the scope of the hold.
6. Identify holds on organizational units that the account belongs to, and move the account out of the organizational unit:
   1. Sign in to your Google Admin console.

      Sign in using your administrator account (does not end in @gmail.com).

   2. In the Admin console, go to Menu  DirectoryUsers.
   3. Click the row with the user.
   4. At the left, find the user’s organizational unit and any parent organizational units.
   5. In Vault, click Domain Holds.
   6. Search the list of holds for the user’s organizational unit and any parent organizational units. If the organizational unit is on hold, move the account to an organizational unit that isn’t on hold. You might want to set up an organizational unit explicitly for this purpose to ensure it’s not on hold.

      For instructions, see Add an organizational unit and Move users to an organizational unit.

   7. If the list includes holds with a scope of All accounts, the hold is set on the top-level organizational unit. You’ll need to reorganize users into at least 2 child organizational units so that at least one organizational unit isn’t on hold.
      1. Add 2 or more organizational units. For instructions, see Add an organizational unit.
      2. Move the users whose data you need to hold into one or more organizational units. Move the users who you want to delete into one or more other organizational units. For instructions, see Move users to an organizational unit.
      3. In Vault, update the holds with All accounts scopes so that they apply only to the organizational units with users you need to have on hold.
7. Wait 24–48 hours for the Directory and Vault settings to completely update.
8. Delete the user. For instructions, see Delete or remove a user from your organization.