What happens to your data when you sell old IT equipment

The laptop in the cupboard still has email on it. The server you switched off in March still has a database file someone forgot. Selling that equipment is a good idea. Handing the data to the next owner is not. This is the plain version of what should happen to your data between ‘we do not want this anymore’ and ‘someone else is using it.’

Deleting files is not wiping. Emptying a recycle bin is not wiping. A factory reset on some devices is close, and on others it is a coat of paint. A format often leaves the data recoverable with ordinary tools. If the device stored customer records, staff files or anything you would not pin to a noticeboard, treat the storage as the asset that matters. The metal around it is secondary.

What to do before it leaves your building

Make the list. Model, serial if you have it, and whether the device powers on. Note which machines held sensitive data. Sign out of accounts where you can, and remove them from your device-management console so a laptop does not keep receiving company mail after it is sold. Take the disks out if your policy says disks never leave, and tell the buyer the bays are empty. A surprise missing drive is fine when it was agreed. It is a dispute when it was not.

You can wipe before pickup if you have a method you trust and the time to do it. You can also hand the wiping to the buyer if their process is documented and your security team accepts it. Do not do both in a vague way and assume the other person ‘probably handled it.’ Write down who is responsible. If that person is us, we will say which method we used. If a drive fails erasure, we destroy it. We do not format it twice and hope.

• Laptops and desktops: internal SSD or HDD, and any SD card still in the slot.
• Servers: every drive, including the ones in a caddy at the bottom of the box.
• NAS and external disks: often forgotten because they feel like ‘just storage.’
• Printers and MFPs: address books and stored jobs. Yes, really.
• Network gear: configs can hold passwords and VPN keys. Factory reset is the minimum.

What we do when the kit reaches the bench

We identify the media, then erase it with a method suited to the drive. A pass that is right for a hard disk is not the same operation as a secure erase on an SSD. We do not need to bore you with brand names in a blog post. We do need to be able to tell you, for a given job, what ran and what the result was. That note is the thing your auditor will ask for, not a slogan about ‘military grade.’

Failed drives are separated. They are not sold as ‘untested, sold as seen’ with your old payroll still on the platters. Destruction is the fallback, then recycling. Networking equipment and NAS units are reset so the next owner gets a setup wizard, not your old Wi-Fi key. If you need serial-level paperwork, that is IT asset disposition, and we agree the report before the van is booked. A casual buy-back of one laptop is a lighter process. The wipe is not optional in either case.

What we will not promise

We will not claim a certificate we did not produce. If a downstream recycler issues paperwork, we pass on what that job actually includes. We will not say every device on earth can be wiped in the van on the same afternoon. Volume, encryption and dead machines change the plan. A laptop that will not power on may need the drive removed. Say that on the sell form so we bring the right expectation.

We also will not buy a story that ‘there is nothing important on it’ as a reason to skip the wipe. People are wrong about that in good faith. The cost of erasure is small next to explaining a leaked spreadsheet. If you want the offer to reflect parts-only value because you are keeping the disks, say that. The price changes. The surprise does not.

After the sale

1. Remove the device from asset registers and insurance lists.
2. Revoke accounts and keys that lived only on that machine.
3. Keep the wipe or destruction note with the asset record.
4. If you bought a replacement from us, treat it as a new deployment: your image, your accounts, your disk encryption.

Buying refurbished does not import the previous owner’s data. A machine we sell has been wiped before it is listed. You should still set it up as if it were new to you, because it is. Put your own encryption on. Do not tape the password to the lid. That part is on you, and it is the easy part.

If you remember one thing, remember this: the data is a separate object from the laptop. Selling the laptop without a plan for the data is how ordinary companies end up in awkward conversations. The plan can be short. List the devices, name who wipes them, keep the result. We will do that work with you, or we will tell you if a particular unit needs a different ending. Either answer is better than a shrug and a format.