Erase data on device return and prove it

You erase data on returned devices securely by separating three things: remove accounts and locks, wipe the storage cryptographically or with specialist software, and log the erasure for each device.

A simple factory reset is often enough technically, but not as proof. A device-as-a-service provider like Everphone makes this a fixed part of the return process.

The problem is rarely the technology. It is the gap between "someone reset the device" and "we can prove it". That is where audits fail, and that is where data leaks start when people leave the company.

This article shows which erasure methods exist, the order to work in, and what else you need to secure when someone leaves.

Which erasure methods exist for smartphones, tablets and laptops?

There are three levels: the factory reset by the employee, a wipe command through the MDM, and certified erasure by a service provider. Only the last one produces proof on its own. Which level you need depends on how sensitive the data is and whether the device will be reused.

The standard reference in the industry is the US guideline NIST SP 800-88. Its revision 2 was published in September 2025 and distinguishes Clear, Purge and Destroy. On smartphones, a factory reset usually counts as Clear, the lightest level.

Is a factory reset enough to erase data on return?

On modern, encrypted devices, a factory reset usually erases the data reliably. As the only measure it still falls short, because it neither produces a record nor makes sure that accounts and locks are removed.

On iPhones and iPads, "Erase All Content and Settings" destroys the keys in Effaceable Storage. After that, the user data is cryptographically inaccessible. Android devices work similarly when encryption is active. The data protection authority of the German state of Thuringia points out in a 2025 press release that a reset is not always enough and that encryption should be active beforehand.

This matters for older devices without enforced encryption. If you run a mixed fleet, check the model year before you rely on the reset.

An everyday example: an IT lead gets 40 phones back after a site closure. The employees reset them "somehow". On three devices, the start screen asks for a stranger's Apple ID. The data is gone, but the devices cannot be used. That is the second gap in a reset.

In what order do you erase data on a device return?

Accounts and locks first, then wipe the storage, then check and log. If you reverse the order, you end up with a wiped device that nobody can activate, or with open accounts on a device that is already in the parcel.

1. Set the device to "returned" in the MDM and block the employee's access before the device is collected.
2. Remove private accounts. On Apple devices that is the Apple ID with Activation Lock, on Android the Google account.
3. Remove the SIM card and memory card, and delete eSIM profiles.
4. Reset the device or wipe it through the MDM.
5. After it arrives, erase it with certification, check its condition and file the report.
6. Only then move the device to stock or refurbishment.

The pitfalls sit in step 2. On Apple devices, Activation Lock stays in place after a wipe command as long as a private Apple ID is linked. Android's Factory Reset Protection behaves differently. A reset from the settings does not trigger it on fully managed devices, while a reset through the recovery menu usually does if a Google account is on the device. So decide in advance which accounts may remain active during a reset. You can only configure that beforehand, not afterwards.

A wipe command through the MDM also only works if the device can be reached. A locked or switched-off device will not accept it. For BYOD accounts enrolled through User Enrollment, you cannot wipe the whole device anyway, only remove the work data.

How do you prevent data leaks when people leave?

A data leak at departure rarely happens on the device. It happens in the accounts that are still active when the device is already back: cloud storage, email, messenger, calendar, password manager. Wiping the device is only half the job.

Go through four points for every departure:

• Block access on the last working day, not when the parcel arrives. The time in between is the risk.
• Assign business data in the cloud and mailbox to a successor before the account is deleted.
• Revoke work authenticator apps and certificates. They sit on the device but remain valid.
• Clarify private data on the device. If employees also used the phone privately, they need a deadline to back up before it is wiped.

The separation of work and private use is often underestimated in practice. A usage agreement that sets out the process at departure helps. How you organise returns as a whole is covered in our article on device returns in offboarding.

What must an erasure record contain?

A usable erasure record names the serial number, the date, the method and the result for each device. Blanket confirmations such as "all devices were wiped" are of little help in an audit, because they cannot be tied to any single device.

The legal background is the accountability principle. Under Art. 5(2) GDPR, you must be able to demonstrate that you comply with the principles of processing, including storage limitation. And if a service provider processes data on your behalf, they must delete or return it at your choice once the contract ends (Art. 28(3)(g)). Both apply to devices just as they do to portal data.

The record belongs in your inventory, next to purchase date, user and return date. How to turn it into an audit-proof device history is described in Audit trail for company devices. The contractual side for rented devices is covered in Is device as a service GDPR-compliant?.

For comparison: at Everphone, certified erasure and refurbishment after the return are part of the service, at no extra cost. The storage is overwritten with a partner's specialist software.

What happens to devices that cannot be erased?

A device that no longer boots cannot be erased with software. The only option is to destroy the storage physically and document it. In NIST terms that is Destroy, the last level, used when Clear and Purge are not possible.

This mainly affects devices with water damage or a defective mainboard. Define in your process who records such devices and where they go. A broken device in a cupboard is an unresolved data protection problem. At Everphone, defective returns that cannot be erased (for example with Blancco) are physically destroyed by an external partner.

The destruction is documented per device with a destruction certificate and can be retrieved in the back office and the customer portal. The certificate contains the destruction date, partner ID, project reference, IMEI or serial number (where legible) and the status "destroyed E-4".

When is a service provider worth it for erasure?

Once more than a handful of devices come back each year, or they are meant to be reused, a fixed solution pays off. For single devices, a clean factory reset with a checklist and a photo of the start screen is enough. For fleets, you need reports that are produced without manual work.

A service provider is especially worth it if:

1. the devices are refurbished and reissued after the return,
2. you need to pass audits or certifications,
3. nobody in IT has time to check returned devices one by one.

It is not worth it if you physically destroy devices after use anyway and document that cleanly. That is the more expensive and less sustainable option, though. More on handling old devices is in Secure phone disposal.

Frequently asked questions

How is data erased when devices are returned?

First, accounts, locks and SIM cards are removed. Then the storage is erased by factory reset, MDM command or specialist software. Finally, the erasure is logged for each device.

Is a factory reset enough to erase data?

Technically, on encrypted devices it discards the keys and makes the data unreadable. As proof it is not enough, because it produces no record. On devices without active encryption, it is not enough technically either.

How do you prevent data leaks when employees leave the company?

Block access on the last working day, not when the device arrives. Assign cloud and mail data to a successor and revoke authenticator apps and certificates. Erase the device only after that.

Why can't a returned iPhone be set up again?

Usually Activation Lock is still tied to the private Apple ID. A wipe command does not remove it. If you manage the devices through an MDM, you can manage the lock in advance. On unmanaged devices, the employee has to remove it themselves.

How much does certified data erasure cost?

There is no general figure, because prices depend on the provider and the quantity. With device as a service, erasure after the return is included in the service.