A business should wipe old company phones, record what happened to each one, then resell, reuse or recycle them through a compliant route. Leaving them in a cupboard is the worst option. Those phones still hold company data, they lose resale value each month, and nobody remembers who is responsible for them.
For a growing team, a phone refresh can leave dozens of handsets behind. A simple process deals with the two real risks: data leaving the business, and electrical waste going the wrong way.
Why are old work phones a data risk?
Old work phones are a data risk because they can hold email, client contacts, files and saved logins long after their last use. The National Cyber Security Centre says data that is sensitive to your business should be sanitised before the device leaves organisational control. Sanitising means removing data so that it cannot be recovered.
The same guidance warns that hitting Delete is not enough. It also tells organisations to have a re-use and disposal policy in place. For most small businesses, that does not need to be long. It needs to exist, and someone needs to own it.
How should a business wipe company phones?
A business should wipe company phones with a factory reset on encrypted devices, then confirm the result. Modern phones usually encrypt their storage, and the National Cyber Security Centre explains that a factory reset deletes the encryption keys, which makes the data unreadable.
Work through each phone in the same order:
- Move any data the business needs to keep.
- Sign out of company accounts and email.
- Remove the device from your mobile device management system, if you use one.
- Remove the staff member’s personal accounts, or Activation Lock can block resale.
- Run the factory reset.
- Check that the phone restarts on the welcome screen.
- Take out the SIM and any memory card.
Phones holding highly sensitive data may need more than this. In that case, read the full National Cyber Security Centre guidance, or use a specialist that can provide evidence of erasure.
What are a business’s legal duties when disposing of phones?
A business must deal with old electrical equipment correctly once it no longer needs it. NetRegs, an environmental guidance service for businesses, makes this point about the WEEE rules. WEEE stands for waste electrical and electronic equipment.
In practice, NetRegs says your duty of care includes storing waste equipment safely, using a registered waste carrier and keeping a waste transfer note when equipment leaves your site. A phone that goes to a buyer for reuse is a different situation from one going as waste, so ask your provider which applies and what paperwork you will get.
Personal data is a separate duty. If the phones hold information about staff or customers, data protection rules still apply when you dispose of them. Ask your data protection lead to sign off the process.
What records should you keep?
You should keep a simple record that shows what each phone was, who had it and where it went. A spreadsheet is enough for most small teams.
| Record | Example | Why it helps |
|---|---|---|
| Device and IMEI | iPhone 13, IMEI number | Identifies the exact phone |
| Last user | Staff name or role | Shows who to ask about it |
| Wipe date and method | Factory reset, 6 Nov | Shows data was dealt with |
| Who did the wipe | IT lead | Gives you clear ownership |
| Destination | Sold, reused or recycled | Closes the loop |
| Paperwork | Transfer note or invoice | Supports your duty of care |
The IMEI is a unique number for each handset. Dialling *#06# usually shows it on screen, so capture it before the reset.
Should you sell, reuse or recycle old company phones?
Choose in that order of value: reuse first, then sell, then recycle. A working phone can often do another job in the business, for example as a shared device for a warehouse or a spare for new starters.
- Reuse: Best if the phone still gets security updates. Check the maker’s published support period first.
- Sell: Best for working phones that are surplus. Values fall over time, so avoid storing them.
- Donate: A good option for charities, but the wipe and records still apply.
- Recycle: Best for broken or very old phones. Never put them in general waste.
For ten or more devices, posting them one by one makes little sense. Services for bulk device recycling can price a batch and collect it. Ask for one figure for the lot, a clear statement of what happens to anything beyond reuse, and the WEEE paperwork.
What should you ask a recycling provider?
Ask a recycling provider what happens to the data, the devices and the paperwork. A good provider will answer these without hesitation.
- Are you a registered waste carrier, or do you use one?
- What documents will we receive?
- Do you erase devices again, and can you evidence it?
- What happens to phones you cannot reuse?
- Is the price fixed, or can it change after inspection?
- Who covers collection and any returns?
Build the process before the next refresh
Pick an owner, write down the steps and start a simple log. Then deal with the phones you already have, before they lose more value. An hour this month can clear the cupboard and close a risk that most small businesses never check.
This article is general guidance, not legal advice.