The end of the year is when many small businesses replace aging laptops, phones and network gear. The new equipment gets set up, and the old equipment ends up in a closet, a back room or a box headed for donation. That pile is easy to forget, but it often still holds email, customer records, financial files and saved passwords.
Retiring devices properly takes a little planning, and it protects both your business and your customers. Here is how to approach it without turning it into a project.
Why deleting files is not enough
Deleting a file usually removes only the pointer to it, and even a reformatted drive can often be read with freely available recovery tools. Devices also hold more than people expect. Copiers and multifunction printers may keep copies of scanned documents on an internal drive. Phones carry email, text messages and the authenticator apps your staff use to sign in. An old router can still contain Wi-Fi passwords and VPN settings for your office.
There can be legal obligations too. The FTC's Disposal Rule requires businesses that use consumer report information, such as background or credit checks, to dispose of it securely. Many states require reasonable disposal of personal information, and businesses covered by HIPAA or the FTC Safeguards Rule have their own expectations for how data is destroyed.
This article is general information, not legal advice. Confirm what applies to your business with your attorney or compliance advisor.
Know what you are retiring
Before anything leaves the building, make a simple record of each device: what it is, its serial number, who used it and where it is going. This takes minutes, and it gives you proof that disposal was handled deliberately. It also makes it obvious when a device has gone missing, which is worth knowing on its own.
Next, make sure nothing on the device is still needed. Confirm that the user's files are in shared cloud storage or a backup, and export anything from software that only stores data locally. Pay special attention to phones: if someone uses an authenticator app for two-factor sign-in, move it to their new phone before the old one is wiped, or they may be locked out of important accounts.
Disconnect it from your accounts
A wiped device can still cause trouble if it is tied to your accounts. Remove it from Microsoft 365 or Google Workspace and from any device management console you use. On Apple devices, turn off Find My; on Android, remove the Google account. Skipping this step leaves the next owner stuck behind an activation lock, which often means the device comes back to you. Finally, release its seat in your security software license so you are not paying for a machine you no longer own.
Wipe it to a recognized standard
NIST Special Publication 800-88, the federal Guidelines for Media Sanitization, is the reference most businesses and recyclers work from. NIST published Revision 2 in September 2025, which puts more emphasis on having a written sanitization policy and on confirming that a wipe actually worked.
For a small business the practical version is straightforward. Modern iPhones and Android phones are encrypted by default, so a factory reset makes the data effectively unreadable. Laptops that had BitLocker or FileVault turned on can be erased with the built-in reset option, which discards the encryption keys. Unencrypted hard drives need a reputable secure-erase tool, or they should be physically destroyed. For printers and copiers, follow the manufacturer's instructions for clearing stored data, or ask your leasing company how they handle it when the equipment goes back. When a drive held especially sensitive information, physical destruction is the simplest way to be certain.
Decide where it goes, and write it down
A wiped device can often be reused in a less demanding role, donated or recycled. If you donate, keep a note of where it went. If you recycle, use a certified electronics recycler and ask for a certificate of recycling or destruction. Many states also restrict throwing electronics in the trash, so the dumpster is rarely an option anyway.
To make the job repeatable, capture it in a one-page disposal procedure. A good one answers four questions:
- Who approves a device for disposal?
- How is each type of device wiped or destroyed?
- Where do retired devices go, and who takes them there?
- What records do you keep, and for how long?
With that page in place, disposal gets done the same way every time, even when someone new handles it.
Encrypt now, dispose easily later
The best time to make disposal easy is when a device is first set up. With full-disk encryption turned on for every laptop and phone, retiring a device later is mostly a matter of a reset. It also means a lost or stolen device is far less of a problem, because the data on it cannot simply be read.
How we help
Bitnode Technologies helps US small businesses plan device refreshes, encrypt laptops and phones, and retire old equipment with a documented wipe and disposal process. We provide remote support nationwide, with on-site visits by arrangement. Book a free 30-minute consultation and we will help you clear out that closet safely.
Useful references
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, National Institute of Standards and Technology
- Disposal of Consumer Report Information and Records Rule, Federal Trade Commission
- Cybersecurity for Small Business, Federal Trade Commission
- Sustainable management of electronics, US Environmental Protection Agency
Cover photo by Niklas König on Unsplash.