How to dispose of company mobile phones: data, compliance and value

14 October 2026 · 8 min read

Every refresh cycle leaves a business with a drawer of old phones and tablets. They hold company data, they still have resale value, and they come with legal obligations. Here's how to retire them properly, in the order that avoids the usual problems.

Start with an inventory

You can't dispose of devices properly if you don't know which ones you have. Before anything moves, record for each device:

• make, model and storage;
• IMEI or serial number;
• who had it, and where it is now (a site, a drawer, a member of staff's home);
• whether it's enrolled in your device management system.

This list becomes the backbone of your audit trail: each line should end with a record of how that device was erased and where it went.

Release devices from management and accounts

This is the step that most often stalls a disposal. A phone still attached to your systems can't be reused by anyone else:

• Mobile device management (MDM): retire or remove the device in your MDM platform.
• Automated enrolment: devices registered through Apple Business Manager, Android zero-touch enrolment or Samsung Knox Mobile Enrolment can re-enrol themselves after a reset. Release them from those services too, or the next owner will hit your setup screens.
• Activation locks: make sure Find My or Google account protection has been removed. Personal accounts on work phones are a common blocker when a leaver didn't sign out.

Erase data to a recognised standard

A factory reset is a reasonable step for a personal phone. For company devices, you want erasure you can prove. Under UK GDPR, organisations must keep personal data secure, including when equipment is disposed of, and they need to be able to show how they did it.

In practice that means certified erasure software that:

• works to a recognised standard, such as NIST SP 800-88 or IEEE 2883;
• produces a certificate for each device, tied to its IMEI or serial number; and
• comes from a provider whose process is independently certified, for example by ADISA.

Keep the certificates with your inventory. If you're ever asked what happened to a particular device, you can answer with a document rather than an assumption.

Know what each device is worth before it moves

Many organisations ship old devices to a disposal partner and accept whatever value comes back. The trouble is that the condition, and therefore the price, is decided after the devices have left your hands. That makes the figure hard to check and hard to compare.

A better order is to test first. A hardware diagnostic on each device establishes its grade, battery health and identity before anything ships. You then know what the fleet is worth, which devices are worth repairing, and which are only fit for recycling, while the devices are still in your hands.

Keep a chain of custody

From the moment a device is collected to the moment it's erased and resold or recycled, there should be a record of who had it. Ask any partner for:

• collection records that list devices individually;
• erasure certificates per device;
• confirmation of what happened to each device: reused, resold or recycled.

Recycle what can't be reused

Devices with no resale value still need responsible handling. Electrical equipment is covered by the UK's Waste Electrical and Electronic Equipment (WEEE) rules, so use a recycler that can document what it received and how it was processed.

A checklist to work from

• Inventory with IMEI or serial for every device
• Devices retired in MDM and released from automated enrolment
• Activation locks and personal accounts removed
• Certified erasure, with a certificate per device
• Each device tested and valued before it ships
• Chain-of-custody records from collection to final outcome
• Non-reusable devices recycled under WEEE rules