Free template
Laptop data wipe and disposal checklist
A laptop that comes back from a leaver still holds their email, files and saved passwords. Before it goes to the next person, back to a vendor or out as e-waste, it needs the same few steps every time. Here they are, with a sheet to keep for each device.
Updated 30 October 2026
Why it matters
The Digital Personal Data Protection Act, 2023 expects organisations to protect personal data with reasonable security safeguards and to erase it when it is no longer needed. A laptop handed to the next joiner, or sold to a dealer, with the last user’s files on it fails both. A recorded wipe is also your evidence that you took care.
There is a practical reason too: a phone still linked to the previous user’s Apple ID or Google account cannot be set up by anyone else.
The steps, in order
Order matters: remove accounts and locks before erasing, or the device may lock itself after the reset.
- Copy any company data the business still needs
- Sign out of and remove Microsoft, Google and Apple accounts, including Find My
- Remove the device from device management (MDM)
- Remove BIOS passwords, activation lock and Android factory reset protection
- Erase the storage with a factory reset on an encrypted drive, or the maker’s secure erase
- Take out SIM and memory cards
- Inspect, record the condition and update the register
The format
Copy it as it is, or download the Word file and add your logo.
Device wipe and disposal checklist
- Asset tag
- Device and model
- Serial number
- Last user
- Returned on
- Next: reissue / repair / sale / e-waste
Before the device leaves IT
| Step | Done | By | Date |
|---|---|---|---|
| Copy any company data the business still needs to the approved location | |||
| Sign out of and remove accounts: Microsoft, Google, Apple ID and Find My | |||
| Remove the device from MDM (for example Microsoft Intune) | |||
| Remove device locks: BIOS or firmware password, activation lock, Android factory reset protection | |||
| Erase the storage: factory reset with encryption on, or the maker’s secure erase | |||
| Remove SIM and memory cards | |||
| Inspect the device and record its condition; photograph any damage | |||
| Update the asset register: in stock, sold or disposed |
Only if the device is sold or scrapped
| Step | Done | By | Date |
|---|---|---|---|
| Remove asset tags and company labels | |||
| For e-waste, hand over only to a registered recycler or refurbisher and keep their receipt | |||
| For a sale, raise the sale bill and record the buyer |
- Recycler or buyer
- Certificate or bill number
Wiped by: name, signature and date
Checked by: name, signature and date
When the device is sold or scrapped
Remove asset tags so the device is not mistaken for company property later, and raise a sale bill or record the disposal in the register. The E-Waste (Management) Rules, 2022 expect organisations to hand e-waste only to registered producers, refurbishers or recyclers; keep the receipt with the device record. Check the current rules with your compliance adviser.
Keep a record for each device
One sheet per device: who wiped it, when, how, and where it went next. If a former employee or an auditor ever asks what happened to a laptop, the answer is in one place.
Quarantine until wiped
In AssetVow, laptops, desktops, phones and tablets that come back go to quarantine and cannot be handed out again until someone completes the wipe checklist: data wiped, accounts and MDM removed, locks removed, inspected. Waiting devices sit in IT’s work queue.
See how it worksFAQ
Common questions
Is a factory reset enough to wipe a laptop?+
On a drive that was encrypted, a factory reset that removes the encryption key leaves the old data unreadable. On an unencrypted drive, use the maker’s secure erase or a wiping tool before reuse or sale.
Why remove accounts before resetting?+
Apple activation lock and Android factory reset protection tie a device to the last account. If you reset first, the next person may not be able to set it up.
Does the DPDP Act require a wipe certificate?+
The Act expects reasonable safeguards and erasure of personal data when it is no longer needed; it does not prescribe this exact form. A record per device is good evidence that you did it. Ask your legal adviser for your specific obligations.
Can we give old laptops to employees?+
Yes, after the same wipe and with the sale or gift recorded in the register.
Never hand out an unwiped laptop again
AssetVow holds returned devices in quarantine until the wipe checklist is done. Free for 30 days.