Ask most small business owners what happens when an employee hands back their laptop and you’ll get a vague answer. Something about IT sorting it. Someone wiping it at some point. Maybe.
Which is fine, until it isn’t.
The honest reality is that returned devices sit in a grey area for a lot of companies. Not urgent enough to deal with immediately, not forgotten enough to ignore completely. They end up in a drawer, or a cupboard, or on someone’s desk for three weeks while everyone assumes someone else is handling it. And during that time, the data on the drive is just… there.
Decide Early Whether It Needs a Full Wipe or Something Lighter
This is arguably the first real decision, and it’s not as obvious as it sounds. Plenty of IT teams default to wiping everything, which seems thorough but can actually create problems. If the device is being redeployed quickly, a full reset means reconfiguring licences, reinstalling software, rebuilding the setup from scratch. For a small team, that’s several hours of work that might not be necessary.
There’s actually a fair bit of nuance to figuring out what to do with work devices when staff leave – particularly the question of partial cleans versus full resets, and when each makes sense. The short version: it depends on what the device was used for and where it’s going next. Worth having a rough policy on this rather than deciding case by case every time.
Sort the Data. Document That You Did.
UK GDPR isn’t especially forgiving on this one. Businesses are expected to handle personal data securely throughout its lifecycle, including when devices change hands. The ICO publishes guidance on data security that covers this, and the expectation is clear enough: you need to be able to show you disposed of data appropriately, not just assert that you probably did.
Here’s the bit most people don’t realise: emptying the recycle bin doesn’t delete files. Not properly. The data’s still on the drive, just marked as available space. Someone with basic recovery tools could pull it back. This isn’t a theoretical risk, it’s a practical one, especially for businesses that handle client records, financial data, or anything health-related.
The NCSC has published guidance on sanitising storage media that goes into the actual methods depending on drive type. It’s worth a read. The takeaway for most small businesses is: use proper wiping software, and log what you did. Not elaborate logging. Just enough to show a decision was made and a process was followed.
Because regulators, in this writer’s experience, are not especially sympathetic to “we assumed the IT person had dealt with it.”
Remove It from Everything
This one gets skipped constantly. The laptop comes back, someone puts it through a wipe, and that’s considered job done. Except the device is still registered in Microsoft 365. Still showing in the MDM system. Still provisioned against a VPN the previous employee could theoretically still access.
Deregistering from cloud services, revoking credentials, removing from device management tools, updating the asset register. None of this is complicated. All of it takes time that nobody wants to spend. And all of it matters, particularly if there’s a security incident later and someone’s asking what access that device had.
Figure Out What Happens to It Next
Three basic options: redeploy it, store it, recycle it. Each one carries different considerations.
Redeployment is usually fine if the previous steps were handled properly. Storage is fine short-term but tends to become “permanent storage in a cupboard” if there’s no plan, which creates its own headaches. Responsible recycling, particularly for older hardware, comes with WEEE obligations a lot of businesses don’t realise apply to them.
The broader point, though, is just having a process. Businesses that manage their operations deliberately, including the less exciting parts like device returns, tend to avoid the kind of scrambling that happens when something goes wrong. There’s a reasonable argument that managing your digital infrastructure carefully is part of managing your wider online presence and digital assets as a business – it’s all connected, one way or another.
Anyway. Returned laptop, four steps. It really doesn’t have to be more complicated than that.
