Company phones and tablets tend to pile up: handsets from leavers, iPads from an old meeting-room setup, a drawer of devices replaced in the last upgrade. Each one may still hold email, contacts, client photos, chat history and saved sign-ins. Here is a practical way for a business to retire them so nothing is left behind and you can show what happened to each device.
Start with a list of every device
Before anything is reset, write down what you have. For each phone or tablet, record the make and model, the serial number and, for phones, the IMEI (dial *#06# on most handsets, or look in the settings or on the box). Note who used it, whether it is enrolled in your device management system, and whether it still works.
This list is what you will tick off later against a wipe report or a data destruction certificate. Without it, you have no way of knowing whether the handset that went missing from a cupboard two years ago was ever dealt with.
Check whether anything needs keeping
A reset is permanent, so check first. Ask whether the device holds anything the business still needs that isn’t stored elsewhere: photos taken on jobs, voice notes, chat messages with clients, or two-factor authenticator codes that protect company accounts. Move authenticator apps to the new device before the old one is wiped, or staff can be locked out of business systems.
If the user is involved in a dispute, complaint or investigation, speak to whoever handles legal matters before wiping their device. Under UK GDPR you shouldn’t keep personal data longer than you need it, but you also shouldn’t destroy something you may be required to produce.
Remove the locks that tie a device to an account
Modern phones have anti-theft locks that survive a reset. If you skip this step, the device may be unusable for anyone else, and a reseller or recycler may reject it.
- iPhone and iPad: Activation Lock is linked to the Apple Account signed in to Find My. Sign out of the Apple Account on the device before erasing it. If the device is supervised through Apple Business Manager and your device management system, the administrator can usually clear Activation Lock from there.
- Android: Factory Reset Protection asks for the last Google account used on the device after certain resets. Remove the Google account (and any Samsung account) in settings before resetting.
- Company enrolment programmes: if your devices were bought through Apple Business Manager, Android zero-touch enrolment or Samsung Knox Mobile Enrolment, release or remove them from that programme once they are leaving the business. Otherwise a device you have sold or passed on may keep trying to enrol into your organisation.
Selective wipe or full wipe?
Most device management tools offer two options. A selective wipe (Microsoft Intune calls it Retire) removes company email, apps and settings but leaves personal data alone. A full wipe returns the device to factory settings.
- Company-owned devices leaving the business, or being reissued to someone else, should get a full wipe.
- Staff-owned phones used for work (bring your own device) normally get a selective wipe when the person leaves. You can’t erase or destroy a device that belongs to an employee, so make sure your BYOD policy explains what will be removed and when.
After a full wipe, check the device: it should start at the set-up screen with no accounts on it, and your management console should show it as wiped or removed.
Why a reset is usually enough, and when it isn’t
iPhones and iPads with a passcode, and most Android devices from recent years, encrypt their storage. A full reset destroys the encryption key, which leaves the old data practically unreadable. That is why a working, properly reset phone can normally be reused or resold.
A reset isn’t enough, or isn’t possible, when:
- The device won’t power on, has a broken screen you can’t work around, or is stuck on a locked account you can’t clear. Its data is still on the chip.
- It is an older or unusual model where you can’t confirm that encryption was switched on.
- It held highly sensitive data, such as health, legal or financial records, and your policy says devices like that must be destroyed rather than reused.
Those devices should be physically destroyed, and each one should appear on the certificate by serial number or IMEI so you can match it to your list.
Don’t forget SIM cards, eSIMs and memory cards
- SIM cards: remove them, then cancel or reassign the number with your network so calls and verification texts don’t keep going to an old handset. Shred SIMs you no longer need.
- eSIMs: when erasing an iPhone you will be asked whether to keep or remove the eSIM. Remove it unless the number is moving to a new device, and check with your network.
- microSD cards: some Android phones and tablets take a memory card, which may not be covered by the phone’s encryption. Take it out and wipe or destroy it separately.
Storing, collecting and recording
Keep retired devices in a locked cupboard until they are dealt with, rather than on desks or in a shared drawer. If batteries are swollen, don’t charge them, keep them apart from other devices and tell whoever collects them, because damaged lithium batteries need careful handling. Phones and tablets are electrical waste and must not go in the general bin.
When the work is done, file the wipe reports and the destruction certificate with your device list. Our FAQ covers how collections and certificates work, and our hard drive disposal and recycling page explains what happens to the equipment afterwards.
Need help with old devices?
We provide certificates of destruction, use government-approved methods and are registered with the ICO (ZA060744). To arrange secure disposal, book a collection or call us on 020 7064 4996 to talk through what you have.