Before an old computer or phone leaves the business, move what you need, sign it out of every account, remove it from two-step verification, erase it properly, and write down where it went and how it was wiped.

The laptop under the tree

Christmas brought a new laptop for the front desk and a new phone for the owner. The old ones still work, so they are going to family, to staff, to a drawer or to recycling.

On the way out, each is still a key to the business. The email program opens without a password, the browser fills in the bank login, and the phone receives the codes that protect the email account.

Somewhere on each one are files nobody remembers saving: scanned forms, exported customer lists, photographs of documents taken for convenience.

None of it shows from outside. A working laptop looks like a laptop, not like the filing cabinet it really is.

What leaves with an old device

The fourth catches people out both ways. A phone that still receives the codes can let someone else in, and a phone wiped before the codes are moved can lock the owner out.

Move what you need first

Before anything is erased, make sure everything worth keeping exists somewhere else: on the new device, the office server or the business's cloud storage.

Look where files hide: the desktop, the downloads and documents folders, and the photographs on the phone. Copy business files to where they belong, not to a memory stick in a drawer.

Customer records found on a personal device belong in the system meant for them. Moving them is a good moment to ask how they got there.

Sign out of everything

Erasing a device does not always sign it out of the accounts it used. Sign out on the device first, then check from each account's side.

Email services list the devices signed in to an account, usually under security settings, and whoever administers the business email can normally remove a device from there.

Remove the old phone from two-step verification, and set up any authenticator app on the new phone before wiping the old one. Codes in those apps rarely move across by themselves.

Sign out of the browser's sync as well, or the saved passwords stay attached to the old machine.

Erasing a computer

Deleting files and emptying the recycle bin removes the signposts, not the files. Recovery tools can bring a surprising amount back.

On Windows 10, the reset under Update and Security, choosing to remove everything and clean the drive, is far more thorough.

Where the computer offers drive encryption, turn it on before the reset. The solid-state drives in newer laptops do not always erase completely by overwriting alone.

On a Mac, sign out of iCloud, then erase the drive from the recovery screen and reinstall the system.

A computer going for recycling rather than to a person can have its drive removed and destroyed instead. Ask the recycler what happens to drives, and get the answer in writing.

Erasing a phone

On an iPhone, sign out of iCloud first, which releases the lock tying the phone to your account, then use Erase All Content and Settings. iPhones encrypt their storage, so the erase is thorough.

On an Android phone, remove the Google account and any business email first, check that encryption is on, then use the factory data reset. Skip the account removal and the next owner may be locked out.

Take out the SIM card and any memory card. A memory card is a separate drive, and the reset may not touch it.

A worked example

A denturist runs a small clinic with two treatment rooms and one receptionist. Over the holidays the clinic replaced its front desk laptop, and the denturist replaced her phone.

The laptop had been promised to the receptionist's son for school. The phone was headed for a recycling box at an electronics store.

Before either left, she went through both with the clinic's computer support. The laptop was still signed in to the clinic's email, with years of patient messages.

Its browser held saved logins for the practice software and the bank, and its desktop held scanned intake forms from a week when the scanner had saved to the wrong folder.

The phone held the authenticator codes for the clinic's email and a messaging app patients had used to send photographs of broken dentures.

The forms went into the practice software, the codes moved to the new phone, and both devices were signed out, encrypted and reset. The clinic's equipment list records each: date, method, who checked it, where it went.

Write down what left

Keep a short list of every device the business owns or uses for work: what it is, who has it, and what happened when it left.

For each departure, note the date, how it was erased, who checked it and where it went. One line per device is enough.

Privacy law expects personal information to be protected until it is destroyed, not just while it is in use. A record made at the time answers questions that memory cannot.

Personal phones used for work

Many small businesses run partly on personal phones: the owner's, a manager's, a staff member's. When those phones are replaced, the business accounts on them leave too, unless someone asks.

Make it routine. When anyone replaces a phone used for work email, messages or the business's social accounts, those accounts are removed and checked before the old phone goes.

The counter-case

A device that never held business email, files or passwords, such as a tablet used only for music in the waiting room, needs only an ordinary reset.

A business with managed computer support may find most of this already happens, though it is worth asking to see the record.

And a laptop moving to another desk inside the business needs the previous user's accounts removed, not a full erase.

For anything leaving the business, the order holds: move, sign out, erase, record.

Before anything leaves

  1. Copy business files to where they belong.
  2. Move authenticator codes to the new phone.
  3. Sign out of email, browsers and apps.
  4. Remove the device from each account's list.
  5. Erase it with encryption switched on.
  6. Take out SIM and memory cards.
  7. Record the date, method and destination.

Step two is the one that cannot be undone. Wipe a phone before its codes are moved, and getting back into the business email may take days of recovery forms.

Keeping card details off office machines in the first place is part of card payment pages and the PCI changes due in February.

Frequently asked questions

Is deleting files enough before giving a laptop away?

No. Deleting removes the signposts, not the data. Use the computer's full reset with drive cleaning, ideally after turning on its encryption.

What should I do before erasing an old phone?

Copy what you need, move authenticator codes to the new phone, sign out of email and the phone maker's account, and remove any SIM and memory cards.

Why remove the phone from two-step verification?

A phone that still receives codes can let someone into the account, and a phone wiped before the codes are moved can lock you out of it.

Does a factory reset erase everything?

On iPhones, yes, because storage is encrypted. On Android, check encryption is on first, and remember the reset may not touch a memory card.

What about computers going to recycling?

Erase them the same way, or have the drive removed and destroyed. Ask the recycler what happens to drives, and get the answer in writing.

Why keep a record of old devices?

If a question ever arises about customer information, a note made at the time showing the date, method and destination answers it in a way memory cannot.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Old laptops leaving the office this week?

Tell us what is going and where. We will help move the accounts and files and erase each one properly.

Start a Conversation