How to Sanitise Employee Devices Correctly

Employee offboarding often fails at the last step. Access is revoked, accounts are disabled and the laptop goes on a shelf, still holding email archives, browser tokens, saved credentials, customer files and regulated data. If you need to know how to sanitise employee devices, the goal is not basic cleanup. The goal is to apply an appropriate sanitisation method, check the reported result and retain records for policy and audit review.

A device that looks ready for the next user is not automatically safe to release. IT teams need a repeatable process that matches the storage type, clears retention holds first and produces evidence that the organisation can defend later.

What are the best practices for wiping laptops before reassigning them to another employee?

Retain required data, remove the device from accounts, sanitise the drives with a suitable method, verify and record the result, then reimage and assign. Do not rely on deleting the old user profile.

What sanitising employee devices actually means

Sanitising a device is not the same as deleting files, reimaging the operating system or sending hardware back to stock with a factory reset. Those actions may make a device look clean, but they do not reliably remove underlying data. On many systems, deleted files remain recoverable until the storage space is overwritten or cryptographically erased through an approved process.

For IT teams, device sanitisation means applying a method that makes practical recovery infeasible at the assurance level provided by that method, documenting the action and matching the approach to the device type and business purpose. A laptop headed for internal redeployment may require a different workflow than a smartphone being returned to a carrier or a workstation leaving the company through IT asset disposition.

That distinction matters for compliance. Standards and regulations do not reward informal cleanup. They expect a defensible process with consistent execution.

When you need to sanitise employee devices

The most obvious trigger is offboarding, but it is not the only one. Devices should be sanitised during hardware refresh cycles, before resale, before donation, at end of lease and before disposal. The same applies when a device changes hands internally between departments, especially if the prior user handled HR records, financial data, legal files, healthcare information or customer databases.

There is also a timing decision to make. Some organisations sanitise immediately at collection. Others first preserve records for legal hold, HR review or incident response. Sanitisation should happen only after retention obligations are cleared, but once that point is reached, delay creates unnecessary exposure.

A defensible sanitisation process

A repeatable process starts before the wipe itself. First, identify the asset and confirm ownership, user assignment and storage type. A Windows laptop with an SSD, a MacBook with soldered storage and an employee-issued mobile phone may all require different handling. If you skip that validation, you risk applying the wrong method or missing a secondary drive entirely.

Next, determine whether any data must be preserved. Legal, compliance and HR teams may require mailbox exports, local file collection or chain-of-custody documentation before sanitisation begins. Move too fast and you may destroy records you were required to retain. Move too slowly and you leave sensitive data sitting on unneeded hardware.

Once retention is resolved, revoke access and remove the device from management workflows as needed. That includes identity tokens, MDM enrolment, remote management ties and encryption key dependencies. For encrypted devices, encryption helps reduce exposure in transit, but it should not be treated as a substitute for sanitisation if the device will be reused, sold or disposed of.

Then perform the sanitisation using a standards-aligned erasure method appropriate to the device. For magnetic drives, overwriting may be suitable. For many SSDs and flash-based devices, the method depends on the controller, firmware support and whether a verified secure erase or cryptographic erase can be executed properly. A method that works on one storage class may be incomplete or inefficient on another.

Finally, verify the result and record it. Verification is not optional. A completed process without reliable records is hard to defend during an audit or incident review.

Why factory reset is usually not enough

Factory reset is designed for usability, not standards-aligned sanitisation. It removes user access and restores system defaults, but it may leave recoverable data in storage areas that were not fully erased. That is especially relevant for laptops and desktops where operating system resets often preserve recovery partitions, unallocated space or residual user artefacts.

Mobile devices are more nuanced. Modern phones that use full-disk encryption may rely on key destruction as part of a reset flow, which can be effective when implemented correctly. Even then, organisations should avoid assumptions. Device age, OS version, MDM controls, removable media and business policy all affect whether a reset alone meets internal and regulatory expectations.

If the device is leaving organisational control, the safer position is to use a validated sanitisation process with verifiable results.

Storage type changes the method

Hard disk drives and flash storage do not behave the same way. Traditional overwrite approaches were built around magnetic media. SSDs introduce wear levelling, hidden blocks and controller-level behaviour that can make simplistic overwrite routines unreliable if the process is not designed for solid-state storage.

That does not mean SSDs cannot be sanitised. It means the erasure method must match the medium. IT teams should confirm whether the software supports the target drive type, whether verification is built in and whether the process aligns with recognised sanitisation guidance such as NIST and relevant industry requirements.

The same principle applies to mobile devices. Company-issued phones and tablets may hold corporate email, authentication apps, cached files, health data, customer communications and cloud access tokens. Sanitisation needs to address the whole device lifecycle, not just desktop endpoints.

Compliance is part of the process

Organisations in healthcare, finance, education, legal services and government-facing environments cannot treat device sanitisation as an informal IT task. If employee devices handled protected health information, financial records, student data or personal information, the wipe process becomes part of your compliance posture.

Your procedure should map to recognised standards and internal policy. NIST guidance is often the operational benchmark for media sanitisation. Depending on your environment, IEEE-aligned practices, GDPR accountability requirements or HIPAA safeguards may also shape how you document and validate erasure. The point is not to collect acronyms. The point is to make sure your process is defensible if someone asks what happened to the data on a retired device.

For many teams, the weak spot is evidence. A wipe that cannot be verified or reported is difficult to show later. Certificates, logs, asset identifiers, timestamps and operator records all strengthen audit readiness.

Operational mistakes that create unnecessary risk

The most common failure is relying on deletion or OS reinstallation. The second is inconsistency: one technician uses a proper erase workflow, another performs a reset and marks the asset complete. The third is poor asset tracking, where devices sit in storage waiting for disposition while still containing active user data.

Another recurring issue is separating sanitisation from the rest of the asset workflow. If offboarding, inventory, compliance review and disposition happen in different systems with no control point, devices get missed. A sound process ties collection, approval, erasure, verification and final disposition together.

There is also a cost mistake that buyers notice quickly. Some erasure tools are priced in ways that punish volume, whether through per-device charges or recurring subscriptions. For teams handling routine refreshes, seasonal projects or high-volume disposition, that model can turn a basic security requirement into a budgeting problem.

Build a repeatable workflow

The strongest workflow is the one your team will execute the same way every time. In practice, that means documented intake, clear retention checks, standards-aligned wiping, automated verification and retained records. It should work whether you are processing five laptops from a small office or hundreds of endpoints from a refresh project.

Purpose-built erasure tools help here. A USB-based data erasure platform can reduce technician time, standardise execution across device batches and simplify records of the method and reported result. For organisations that process devices regularly, unlimited-use licensing and no subscription overhead can also make the workflow easier to sustain. We built RedKey USB for that operational need: standards-led data erasure, straightforward deployment and repeatable results without recurring software costs. PDF erasure reports are included in the Professional and Ultimate editions; the Home edition shows the result on screen only.

Still, the tool is only part of the answer. Governance matters just as much. Assign ownership, define approvals and make sure device sanitisation is embedded in offboarding and disposal policy rather than treated as an optional cleanup step.

How to decide what done looks like

A sanitised employee device should meet three tests. The method was suitable for the device and storage type. Its reported result supports the assurance required by policy. The organisation retained a record of what was done, when and to which asset.

That is the standard worth enforcing. A device is not ready for release because it boots to a setup screen. It is ready only when the organisation’s policy permits release after the selected sanitisation method, reported result and required records have been reviewed.

When employee hardware leaves one user, one department or one lifecycle stage for another, assurance matters more than convenience. Sanitisation done right protects the next transaction before it becomes the next incident.

Frequently asked questions

How do you dispose of employee devices safely?

Treat them like any retired asset: record, sanitise, verify, record and dispose of them through a licensed route.

How do you handle user data during an OS redeployment?

Back up required data to approved systems, sanitise the drive, then install the new image so no previous user data remains.

RedKey USB Professional records each erasure, which helps when devices move between employees. Related reading: How to Wipe Drives for Redeployment Securely and Asset Disposal Documentation That Stands Up.