- Share on
-
-
-
Every business upgrades its tech now and then — laptops slow down, tablets get outdated, and newer models offer better performance. So it’s easy to think: just wipe the old one, sell it, and move on.
But here’s the problem: even after what looks like a factory reset, fragments of your company’s data can stick around — emails, saved logins, customer details, cloud tokens. If the reset wasn’t done correctly — or worse, if someone just deleted files and emptied the recycle bin — that data may still be fully recoverable.
And that’s not as rare a scenario as you might think.
A recent ESET study found that 56% of second-hand corporate network devices still contained sensitive company data — including VPN credentials, hashed passwords, and enough information to identify the previous owner.
That’s not just a cybersecurity issue. It’s a business liability — and one that small businesses are especially vulnerable to without a clear, secure laptop disposal process in place.
In this guide, we’ll break down the risks, debunk common misconceptions, and show you exactly how to retire old devices without putting your data — or your reputation — on the line.
Why factory resets aren’t always enough
A properly done factory reset will wipe everything and reinstall the system from scratch — and that’s enough to securely erase your data.
The issue is that many people don’t perform the reset correctly.
Here’s where things typically go wrong:
- They manually delete files or just empty the recycle bin
- They run a reset but skip key steps, leaving parts of the drive untouched
- They assume any reset is good enough, without verifying that the data is actually gone
In other words, a factory reset works — but only when it’s done properly. And most people don’t know how to do that or don’t double-check the result.
That’s why relying on a reset alone can be risky if you’re not confident in the process. Better to use secure wiping tools or work with an expert who knows how to handle it thoroughly.
The hidden risks of selling old Devices
When a laptop leaves your hands, it may still hold more than just old files — it could hold access to your systems, your customers, or your reputation.
Devices reused or donated without proper preparation can expose:
- Emails, messages, and cached conversations
- Saved credentials for business platforms
- Client records, invoices, and synced documents
- Active access tokens for cloud services
The person accessing this data might not even be malicious. It could be a charity, a refurbisher, or a new employee, unknowingly handed access to sensitive business information.
One overlooked device can lead to data breaches, reputational damage, or compliance fallout — and most small businesses don’t even know it’s happening.
Why small businesses face bigger risks
Larger companies usually have structured IT policies — automated wiping tools, device tracking systems, formal offboarding checklists. Small businesses? Not so much.
Here’s where things often break down:
- Limited IT support: Most small teams lack dedicated staff to manage device retirement and data sanitization.
- Informal offboarding: Laptops may be collected when someone leaves, but what’s actually on them is rarely reviewed.
- Mixed personal and work use: Shared devices often hold both business and personal logins, increasing the exposure risk.
- No clear audit trail: Devices are reused, passed around, or sold without records of who used them or what data they stored.
In these conditions, it’s easy to overlook key steps, and the fallout can be costly. Exposed credentials, leaked client data, or forgotten cloud syncs can lead to regulatory penalties, reputational damage, or active system breaches.
For small businesses, every data point matters. That makes secure device handling not just a technical task, but a business-critical safeguard.
What to actually do before selling or recycling a device
Before handing off an old laptop — whether you’re selling it, recycling it, or donating it — it’s critical to make sure your business data is truly gone. That means going beyond surface-level resets and following a secure, methodical process.
Here’s what you should do:
- Encrypt the drive first
Use tools like BitLocker (Windows) or FileVault (macOS) to encrypt the data before wiping it. This ensures that if anything is left behind, it’s unreadable. - Use a secure data wipe tool
Tools like DBAN or Blancco Drive Eraser overwrite the data multiple times, making recovery virtually impossible — far more reliable than a standard reset. - Sign out of all accounts and deauthorize software
Make sure users are logged out of Microsoft 365, Google Workspace, Adobe, and any cloud services. This prevents sync issues or unauthorized access later. - Remove the device from your MDM or management tools
If your business uses a mobile device management system (like Intune or Jamf), remove the device from that network to sever access. - Record serial numbers and final device status
Log the device’s unique identifiers, who it was last assigned to, and when it was decommissioned. Keep this record for compliance and auditing. - Physically destroy old drives if unsure
For especially sensitive or legacy devices where proper wiping can’t be guaranteed, physically destroy the drive — it’s the only foolproof method.
By building these steps into your offboarding process, you’re not just wiping devices — you’re protecting your business, your clients, and your reputation. Read a full step-by-step guide by clicking here.
Need help putting this into practice?
If you’d rather not handle secure disposal yourself, Operum Tech can take care of it — from data wiping and logging to physical drive destruction. Get in touch to learn how we support small businesses with secure, hassle-free device retirement.
Extra risks if you donate or leave devices idle
Just because a laptop isn’t in active use doesn’t mean it’s safe. In fact, idle or donated devices can pose just as much risk as anything that’s sold on.
Here’s why they shouldn’t be ignored:
- Idle devices are still accessible
A laptop in a drawer can still be booted up. If it wasn’t wiped properly, anyone who finds or inherits it could access sensitive data. - Donation doesn’t mean data destruction
Many charities and refurbishers don’t promise secure erasure. Even with the best intentions, your business data could end up in the wrong hands. - E-waste centres vary in handling protocols
Not all recycling facilities securely wipe or destroy hard drives. Without verification, you’re taking a leap of faith. - Forgotten devices escape audits
If you’re not tracking what devices are still active — or where they’ve gone — you lose visibility and control over potential data exposure.
Whether it’s collecting dust in a storage closet or on its way to a local school, every device should be treated as a data risk until it’s been securely decommissioned.
What businesses should put in place
Retiring old tech doesn’t have to be risky — not if you’ve got the right processes in place. With a few repeatable steps, small businesses can handle device disposal with the same care they give to client data or financial records.
Here’s what we recommend:
- Create a simple device retirement checklist
Include steps like encryption, secure wiping (using tools like Kill Disk or Mac’s secure erase options), account sign-out, and serial number logging. Make this part of your internal SOPs so nothing slips through the cracks. - Work with an IT partner
A trusted IT provider can take the guesswork out of secure disposal. At Operum Tech, for example, we use data erasure tools tailored to the device type and physically destroy drives when wiping isn’t possible. - Run regular device audits
Keep track of what’s in circulation, who it’s assigned to, and what’s no longer in use. Quarterly or biannual audits help keep your inventory clean and your records accurate. - Include remote and hybrid staff in the process
Don’t forget offsite employees. Provide clear instructions for returning or securely decommissioning their devices, especially when roles change or contracts end.
With these steps in place, retiring a device becomes a managed, low-risk process — not a security blind spot.
Don’t let old tech create new problems
Selling or donating a device isn’t the issue — skipping the right steps beforehand is. And for small businesses, even one forgotten laptop can lead to serious consequences: data breaches, lost trust, or compliance headaches.
The good news? Prevention is simple.
With a few extra precautions — encryption, secure wiping, proper logging, and deauthorisation — you can protect your business long after the device is gone.
Not sure what your current process looks like? Or if you even have one?
Now’s the time to fix that.
Talk to Operum Tech about secure laptop disposal — or let us handle it for you. We already use best-practice tools and methods, including full data erasure, factory resets, and physical drive destruction where needed.
Because when it comes to your company’s data, a small action today can prevent major problems tomorrow.
Sign up below to join the Operum newsletter
