How to securely wipe old computers and devices before they leave

Why deleting files isn't enough

Deleting files or emptying the recycle bin only removes the pointers to the data. The files stay on the drive until they are overwritten, and free recovery tools can often bring them back. Even a quick format leaves most data readable. Second-hand laptops, phones and drives regularly turn up with previous owners' emails, client records and saved passwords still recoverable.

For a business, that is a privacy and reputational risk. If old devices expose personal information about clients or staff, it may be a notifiable privacy breach, and explaining that a laptop went to auction without being wiped is not a conversation anyone wants. The fix is straightforward, but it needs to happen every time, not just when someone remembers.

Methods that work

For modern solid-state drives, overwriting every sector with traditional tools is unreliable because of the way SSDs manage storage internally. Better options are the drive's built-in secure erase or sanitise command, a cryptographic erase that destroys the encryption key, or certified data erasure software that supports SSDs and produces a report. If a drive was encrypted with BitLocker or FileVault from day one, the data is already protected, and resetting the device plus removing the key adds a strong layer.

For older mechanical hard drives, certified overwrite software is effective. For drives that have failed, can't be wiped, or held highly sensitive data such as health or financial records, physical destruction by shredding or crushing is the safest option. Drilling holes is better than nothing but less thorough than professional shredding.

Laptops, desktops and phones

For Windows devices managed in Intune, you can issue a wipe command from the console, which resets the device and removes company data. For a full sanitisation before disposal, follow that with a secure erase from the manufacturer's firmware tools where available. Macs with Apple silicon or T2 chips can use Erase All Content and Settings, which destroys the encryption keys.

Phones and tablets should be signed out of all accounts, including Apple ID or Google accounts, removed from device management, and then factory reset. Activation locks must be released, or the device becomes unusable to anyone else and may be worthless for resale or trade-in. Remove SIM cards and memory cards before the device goes.

The devices people forget

Multifunction printers and copiers often contain hard drives or flash storage that hold copies of scanned and printed documents, address books and email settings. Many have a data overwrite or initialise option in the admin menu, and leasing companies may offer a certified wipe when a device is collected. Ask before the truck arrives, not after.

Servers, NAS boxes, external hard drives, USB sticks, firewalls, network switches with saved configurations, phone systems with voicemail and even smart TVs signed into accounts can all hold business information. Include them in the disposal process. A firewall's configuration file, for example, can reveal your network layout and VPN details.

Keep a record

For every device, record the serial number, asset tag, date, the method used to remove data, who did it and where the device went. Certified erasure tools and professional destruction services issue certificates per drive; file these with your asset register. This record shows you handled personal information properly if a client, insurer or the Privacy Commissioner ever asks.

Update your asset register at the same time so the device is marked as disposed of. Remove it from Intune, Apple Business Manager or Autopilot, unassign any licences, and remove it from security tools so it doesn't appear as an offline device forever.

Write the process down as a short checklist so anyone in the office can follow it: back up or confirm files are synced, remove from management, wipe with the approved method, record the serial number and method, then send for reuse or recycling. A checklist means the job is done the same way whether it is a single laptop or a full refresh.

Choosing a disposal or recycling partner

If you use an IT recycler or asset disposal company, ask how they handle data. Good providers collect devices securely, wipe or destroy drives to recognised standards, issue certificates and recycle or resell the hardware responsibly. Find out whether wiping happens at your premises or theirs, and how devices are tracked in between.

For small quantities, wiping in-house with a documented process and then using a reputable e-waste recycler works fine. For larger refresh projects, a certified disposal service saves time and gives you paperwork for every item. Either way, never let a device leave with its data intact on the assumption that someone further down the line will handle it.