Business phone recycling is about more than putting old smartphones in a collection box. If your company is replacing 50, 500 or even 5,000 employee phones, how do you make sure customer data is erased, devices are accounted for and reusable handsets don’t end up as unnecessary electronic waste?
It’s an important question for IT managers, finance teams, recycling businesses and anyone responsible for company-owned mobile devices.
A retired smartphone may contain work emails, customer information, business applications, saved credentials and commercially sensitive documents. Even when the device no longer works, its storage may still contain information.
Meanwhile, companies are increasingly looking for ways to recover value from old equipment rather than simply destroying it.
In October 2026, the UK government updated its IT Reuse for Good Charter guidance, encouraging organisations to take a reuse-first approach to devices such as laptops and smartphones.
However, responsible reuse must begin with appropriate data protection.
This guide explains how business phone recycling works in the UK, what GDPR and WEEE requirements organisations should consider and how to manage secure data erasure.
We’ll also show how MobiWIPE, MobiCode’s professional mobile data-erasure software, helps businesses document and manage smartphone erasure across larger device batches.
Quick answer: How should a business recycle old phones?
A company should maintain an accurate device inventory, protect personal information, select an appropriate erasure method and use an authorised reuse or recycling route.
A practical business phone recycling process should include:
- Identify all company smartphones and their IMEIs.
- Confirm ownership and any contractual restrictions.
- Back up or transfer business information that must be retained.
- Remove relevant account and device-management restrictions.
- Securely erase each handset using an appropriate method.
- Record whether erasure passed, failed or requires investigation.
- Retain device-level evidence where required.
- Assess which phones can be reused, refurbished or donated.
- Route genuine electrical waste through an authorised provider.
- Keep appropriate transaction and disposal records.
Important: A data-erasure certificate and a waste transfer note are different documents. Depending on your activities, you may need both.
What is business phone recycling?
Business phone recycling is the process of handling smartphones that an organisation no longer needs.
For example, a company may replace its employee handsets after three or four years.
Some devices may still work perfectly. Others may need repairs, battery replacements or specialist handling.
The organisation must decide what happens to each phone and how to protect the information it contains.
Business phone recycling vs corporate phone reuse
People often use the word recycling to describe every type of old-device collection.
However, reuse and waste recycling are not identical.
A working smartphone may be suitable for resale, donation or reassignment to another employee.
By contrast, a handset that has reached the end of its useful life may need appropriate electrical waste treatment.
This distinction matters because different legal and operational requirements can apply.
For example, the Environment Agency has published guidance explaining when electrical equipment becomes waste.
Therefore, businesses should assess devices individually instead of automatically treating every retired smartphone as waste.
Who needs corporate mobile phone disposal services?
Several types of organisations regularly retire large numbers of mobile devices.
- Businesses: Replacing employee smartphones during technology upgrades.
- IT asset-disposal companies: Collecting and processing devices for corporate customers.
- Mobile phone recyclers: Preparing suitable handsets for reuse or recycling.
- Telecommunications providers: Handling returned or upgraded customer devices.
- Public sector organisations: Retiring smartphones used by staff and service teams.
- Refurbishers: Testing, erasing and grading used handsets for resale.
- Leasing companies: Processing returned devices when commercial agreements end.
Although their business models differ, these organisations share a common challenge: they need to establish what happened to each device and its data.
Why secure business phone recycling matters
Modern smartphones contain far more information than telephone numbers.
For example, a business handset may provide access to company email, internal messaging, customer records and cloud applications.
Some organisations also use phones for authentication, banking approvals and managing sensitive systems.
Consequently, handing a phone to another person without appropriate preparation can create unnecessary security risks.
Old company phones may still contain personal data
Imagine an employee leaves the business and returns an old iPhone.
The company stores it in a cupboard for several months.
Later, someone decides to sell the handset.
However, the device still contains business application sessions and the employee’s personal information.
Without a proper device-retirement process, that information may leave the organisation with the hardware.
The Information Commissioner’s Office (ICO) advises businesses to make sure personal information has been removed from smartphones and other IT equipment before disposal.
Data security does not end when a phone stops working
A damaged handset may still contain readable data.
For example, a phone with a broken display might have working internal storage.
Similarly, a handset that will not charge may still contain information that specialist equipment could potentially access.
Therefore, businesses should not assume that a faulty phone is automatically safe to discard.
Instead, assess the device and select an appropriate sanitisation or disposal process.
GDPR and business phone recycling: what are the rules?
UK GDPR requires organisations to protect personal information using appropriate security measures.
That responsibility extends to the way businesses handle devices containing personal information.
For example, an employer may have personal data about customers and staff stored locally on a smartphone.
When the handset reaches the end of its useful life, the organisation should take appropriate steps to prevent unauthorised disclosure.
Does GDPR require companies to erase old phones?
Where a company phone contains personal information that no longer needs to remain on the handset, appropriate erasure or sanitisation is generally part of secure disposal.
However, UK GDPR does not prescribe one universal software product or erasure method for every smartphone.
The organisation must select measures appropriate to the information, device and risks involved.
For example, a modern encrypted smartphone may support an effective manufacturer erase process.
Meanwhile, a damaged or unsupported handset might require a different treatment.
The ICO’s Disposal and Deletion audit guidance recommends documented secure disposal methods and controls for equipment awaiting destruction.
Is a factory reset enough for GDPR?
Sometimes, a properly completed manufacturer factory reset is an appropriate sanitisation method.
However, the answer depends on the device and the organisation’s risk assessment.
The UK’s National Cyber Security Centre explains that modern encrypted devices can often be sanitised effectively through the manufacturer’s reset procedure.
In many situations, the reset removes encryption keys so previously stored information is no longer readable.
Nevertheless, the NCSC also warns that manufacturers and devices differ, so a reset does not provide an identical guarantee in every case.
Read the NCSC’s secure sanitisation guidance for the technical background.
What about a failed factory reset?
A failed reset creates uncertainty.
For example, the handset may disconnect from power, encounter a software problem or become unresponsive before completing the procedure.
In that situation, the business should not record the device as successfully sanitised simply because the process started.
Instead, investigate the failure and use an appropriate alternative method where necessary.
This is one reason professional erasure workflows include exception handling and reporting.
What is a mobile phone data erasure certificate?
A mobile phone data-erasure certificate documents an erasure activity against an identified device.
For example, a company may want evidence showing that a specific employee iPhone completed the approved sanitisation procedure before resale.
Similarly, a recycling business may need to provide evidence to a corporate customer after processing a batch of devices.
A device-level certificate can support those requirements.
What information should an erasure certificate record?
The exact fields depend on the service, software and contractual requirements.
However, a useful business record should make it possible to identify the relevant device and understand the result.
| Information | Why it matters |
|---|---|
| Device IMEI or serial number | Identifies the specific handset |
| Device make and model | Provides additional identification |
| Date and time | Shows when the activity occurred |
| Erasure method | Records the relevant sanitisation approach |
| Result | Distinguishes successful erasure from exceptions |
| Operator or processing location | Supports operational accountability |
| Record or certificate identifier | Helps retrieve supporting evidence |
These are recommended considerations rather than a claim that every certificate provider includes each field.
Before purchasing an erasure solution, businesses should confirm which information its actual certificates contain.
Does a certificate prove GDPR compliance?
Not by itself.
A certificate can provide evidence of an erasure process, but an organisation must also manage access controls, device custody, staff responsibilities and other relevant obligations.
Furthermore, a certificate is only meaningful when the recorded method is appropriate and the result is genuine.
Therefore, businesses should treat certificates as part of an evidence-based process rather than an unconditional guarantee.
Data erasure certificate vs waste transfer note
These documents serve different purposes.
An erasure certificate concerns the treatment of information held on a device.
By contrast, a waste transfer note documents the transfer of relevant waste between parties.
For example, a company disposing of non-hazardous waste equipment in England may need a waste transfer note or another document containing the required information.
GOV.UK explains that both parties must retain the relevant non-hazardous waste transfer documentation for two years.
Read the government’s waste transfer note guidance.
How MobiWIPE supports secure business phone recycling
MobiWIPE is MobiCode’s professional data-erasure solution for supported Apple and Android devices.
It helps organisations manage erasure activities, process multiple handsets and keep appropriate device-level records.
MobiCode positions the software for recyclers, refurbishers and companies handling previously owned smartphones.
Certificated mobile data erasure
MobiWIPE generates PDF certificates for erasure activities recorded through its system.
For example, an IT asset-disposal business can use these records when preparing documentation for a corporate customer.
In addition, MobiCode provides a reporting environment for reviewing processing activity.
Consequently, organisations can connect erasure results with their wider device-retirement records.
Erase multiple phones simultaneously
A business processing one handset occasionally may be able to manage it manually.
However, a recycler handling hundreds of devices faces a different operational challenge.
MobiWIPE supports multiple simultaneous handset connections.
Therefore, compatible devices can enter the erasure workflow without waiting for every previous handset to finish individually.
The actual processing speed depends on the devices, equipment and procedures involved.
Identify exceptions during processing
Some smartphones may contain account restrictions or other issues that affect processing.
For example, a device may still be linked to a previous user’s Apple Account or Google Account.
MobiWIPE provides exception alerts and integrates with relevant MobiCode account-checking capabilities.
As a result, operators can investigate supported account-related issues instead of assuming every handset is ready for release.
Importantly, the software does not authorise a business to bypass someone else’s ownership protections.
Reporting across business locations
Organisations with multiple processing teams need consistent records.
For example, an ITAD provider may operate several facilities that handle different corporate customers.
MobiWIPE’s reporting environment provides oversight of users and locations.
Consequently, managers can review activity and investigate processing exceptions more consistently.
ADISA approval and commercial terms
MobiCode describes MobiWIPE as an ADISA-approved erasure application and advertises insured erasure activities.
Businesses should confirm the applicable approval scope, supported devices and insurance conditions for their intended use.
In addition, MobiCode offers volume-based pay-as-you-go tariffs without mandatory monthly or annual commitments on its published product page.
Current pricing should be confirmed directly with MobiCode.
Processing company smartphones for reuse or recycling?
MobiWIPE helps professional organisations manage supported Apple and Android data erasure, generate PDF certificates and review results across devices and processing locations.
Whether you’re an IT asset-disposal provider, refurbisher or company retiring employee phones, explore a structured erasure workflow built for professional device processing.
Key capabilities: Certificated erasure, simultaneous device connections, exception alerts, reporting and flexible PAYG options.
Business phone recycling and WEEE regulations in the UK
The Waste Electrical and Electronic Equipment framework, usually called WEEE, affects how relevant electrical waste is collected and managed.
However, not every used smartphone automatically becomes waste when a company stops using it.
The distinction between legitimate reuse and waste disposal can affect the organisation’s responsibilities.
When does a company phone become WEEE?
The Environment Agency assesses several factors when determining whether electrical equipment remains suitable for reuse or has become waste.
For example, it considers the condition of the equipment, its intended use, evidence of a genuine reuse market and how it is handled.
A phone that can be reused lawfully may follow a different route from an item that someone has discarded as waste.
Therefore, do not automatically treat a working handset and a damaged waste device as equivalent.
See the official EEE and WEEE classification guidance.
Do business phone recyclers need waste carrier registration?
Potentially, depending on what the organisation does.
In England, businesses that transport, buy, sell or arrange the handling of waste may need to register as a waste carrier, broker or dealer.
For example, an ITAD provider collecting waste smartphones may have different responsibilities from a business selling fully working devices for reuse.
The relevant requirements also differ between England, Scotland, Wales and Northern Ireland.
Before collecting waste, review GOV.UK’s registration guidance.
Check the disposal provider’s authorisation
When transferring business waste, the organisation should check that the receiving company is appropriately authorised.
For example, the government’s waste duty-of-care guidance advises businesses to verify relevant waste-carrier registrations.
In addition, companies should describe waste accurately and maintain the required records.
See the Waste Duty of Care Code of Practice.
What about damaged phone batteries?
Damaged lithium-ion batteries require particular attention.
For example, a swollen or physically damaged smartphone battery may create a fire risk during storage or transport.
Consequently, businesses should use appropriate handling procedures and seek specialist guidance where necessary.
Do not place damaged battery-containing devices into an ordinary mixed shipment without considering their condition and the relevant transport rules.
Where devices qualify as hazardous waste, additional classification and documentation requirements may apply.
How to dispose of old company phones securely: step-by-step
A written device-retirement procedure helps businesses process handsets consistently.
Without one, different teams may handle the same equipment in completely different ways.
For example, one department may securely erase phones while another leaves them in an unlocked storage cupboard.
The following workflow provides a practical starting point.
Step 1: Build an inventory of retired smartphones
Start by recording every device included in the retirement programme.
For example, capture its IMEI or serial number, model and current location.
Also record the relevant asset identifier and responsible department.
This creates a clear starting point for tracking devices.
Step 2: Confirm ownership and contract status
Before transferring a phone, establish who owns it.
For example, some business handsets may remain subject to a leasing or rental agreement.
Others might belong to employees under a bring-your-own-device arrangement.
Consequently, the company should not assume every device in its office can be sold or donated.
Step 3: Preserve information that must be retained
Check whether the handset contains business information that needs to be transferred or retained.
For example, a departing employee may have work contacts, documents or authentication applications on the phone.
Coordinate any necessary data transfer before erasure.
However, avoid creating unnecessary copies of personal information.
Step 4: Remove relevant management and account restrictions
Company phones may be enrolled in mobile device management systems.
Some may also contain Apple Activation Lock or Android Factory Reset Protection.
Therefore, the authorised organisation should follow the relevant manufacturer and management-platform procedures before releasing a device.
Importantly, clearing a management restriction is not the same as securely erasing user data.
Step 5: Select the appropriate erasure method
Choose a sanitisation method based on the handset and its data-security requirements.
For example, the manufacturer may provide a suitable reset process for a modern encrypted device.
For higher-volume operations, a professional erasure tool may provide additional workflow control and evidence.
Where sanitisation cannot be completed reliably, the organisation should evaluate another appropriate treatment.
Step 6: Verify the result and record exceptions
After erasure, establish whether the process succeeded.
For example, a device that fails during processing should remain in an exception category.
Do not release it for resale merely because another handset in the same batch completed successfully.
Instead, investigate and document the next action.
Step 7: Retain device-level erasure evidence
Save the appropriate records against the device inventory.
For example, the organisation may retain a PDF erasure certificate and a corresponding asset entry.
Record any devices that require additional work.
That way, staff can identify which handsets are ready for release and which remain unresolved.
Step 8: Test phones intended for reuse
Data erasure does not establish whether a device works properly.
Therefore, phones intended for resale or donation should also undergo suitable functional and cosmetic checks.
For example, a refurbisher may need to test screens, cameras, audio, batteries and connectivity.
Devices with faults may need repair or an alternative route.
Step 9: Choose resale, donation or recycling
Once processing is complete, classify each handset appropriately.
A fully working device may qualify for reuse or resale.
Another may be suitable for repair before donation.
By contrast, equipment that cannot be reused safely may require authorised recycling or disposal.
Step 10: Complete the handover records
Finally, document what happened to each device.
For example, record whether it was sold, donated, recycled or retained for further investigation.
Where waste legislation applies, maintain the necessary transfer documentation.
Consequently, the organisation can account for the full retirement batch rather than only the devices that sold successfully.
How the UK’s IT Reuse for Good Charter changes the conversation
Corporate device retirement is no longer only a question of getting rid of unwanted equipment.
The UK government is encouraging organisations to consider whether devices can support people who lack access to suitable technology.
Its IT Reuse for Good Charter encourages a reuse-first approach.
What does the charter encourage?
The guidance asks participating organisations to prioritise suitable reuse and donation where possible.
For example, a business may be replacing smartphones that still have useful service life.
After appropriate preparation, some of those devices could benefit another person rather than immediately becoming waste.
However, the charter also expects devices to be securely wiped and refurbished appropriately.
Therefore, responsible reuse depends on both data security and device quality.
Why ITAD providers should pay attention
The charter specifically includes IT asset-disposal providers among the organisations that can participate.
Consequently, an ITAD company may need to support customers who want to demonstrate responsible device reuse.
For example, corporate buyers may ask for evidence that donated handsets were securely erased and assessed for functionality.
That creates an opportunity for providers with consistent data-erasure and refurbishment processes.
Reuse-first does not mean reuse-at-any-cost
Not every old smartphone should return to use.
For example, a damaged handset may be unsafe, unsupported or unsuitable for the intended recipient.
Additionally, some devices may contain information that cannot be sanitised to the organisation’s required level of assurance.
In those circumstances, appropriate destruction or recycling may be necessary.
Therefore, reuse decisions should follow technical and security assessments rather than a blanket target.
How MobiONE complements MobiWIPE in device refurbishment
For businesses that both erase and resell used phones, data sanitisation is only one processing stage.
A recycler may also need to identify device restrictions, test hardware and assign an appropriate condition grade.
That’s where MobiONE provides a wider workflow.
MobiWIPE focuses on data erasure
MobiWIPE helps businesses manage supported Apple and Android erasure activity, PDF certificates and related reporting.
Therefore, it is relevant to organisations that primarily need controlled data removal and evidence of processing.
MobiONE supports wider device processing
MobiONE combines relevant device checks, diagnostics, grading and erasure capabilities.
For example, a refurbisher may need to verify device information, inspect functional condition and record a resale grade.
Connecting those stages can help teams maintain a more consistent workflow.
However, staff still need to follow appropriate device-inspection standards and investigate exceptions.
Why these tools complement each other
Consider a batch of 300 retired company smartphones.
The organisation needs evidence that the devices have undergone the appropriate data-erasure process.
Afterwards, a refurbishment partner must establish which handsets still work well enough for resale or donation.
Those are two related but distinct requirements.
As a result, professional erasure software and broader device-processing tools can complement one another.
How much does secure business phone recycling cost?
The cost depends on the number of devices, their condition and the services required.
For example, a batch of working smartphones that already have accurate asset records may require less handling than a mixed batch containing damaged and locked devices.
Businesses should request a quote based on the actual workflow rather than comparing only a headline collection fee.
What costs should an IT manager consider?
Relevant costs may include:
- Device collection and transport.
- Inventory creation and asset reconciliation.
- Data erasure and certification.
- Account and management-lock handling.
- Functional testing and grading.
- Repairs and refurbishment.
- Secure storage and exception handling.
- Waste treatment and required documentation.
- Reporting and customer administration.
However, some working devices may retain resale or reuse value.
Therefore, the net cost of an appropriate retirement programme can differ from the gross processing cost.
Illustrative cost of a 500-phone erasure project
Suppose an organisation needs to process 500 smartphones.
For planning purposes, assume its total erasure-service cost is £2.50 per device.
Hypothetical erasure budget only; not a MobiWIPE quote or published tariff.
That figure excludes collection, storage, testing, repairs and any other requirements.
It also assumes every device can follow the same processing route.
In practice, failed erasures and damaged handsets may require additional work.
Consequently, businesses should obtain actual commercial pricing based on their device volumes and requirements.
What should you ask a corporate phone recycling provider?
Choosing a provider involves more than comparing how quickly it can collect a box of phones.
The company should understand how devices move through the process and what evidence the provider can return.
Ask about data erasure
Which devices and operating systems can the provider erase?
What methods does it use?
How does the provider identify and manage unsuccessful erasures?
Also, ask whether the proposed method meets your organisation’s risk assessment.
Ask about certificates and records
Will you receive device-level erasure results?
Can you match those results to the original IMEI or asset inventory?
Does the reporting distinguish successful processing from failed or unresolved devices?
Additionally, establish how long the provider retains the records and how you can retrieve them.
Ask about security and custody
How are phones stored before processing?
Who can access them?
Will the provider document collection, receipt and onward transfer?
For example, an organisation handling sensitive customer information may require stronger custody controls than one dealing with low-risk equipment.
Ask about approval and insurance
Where the provider advertises a certification, ask which specific service, methods and locations it covers.
For example, an ADISA approval claim should be checked against the applicable scope.
Similarly, confirm relevant insurance arrangements rather than assuming that every potential loss is covered.
Ask what happens to reusable phones
Does the provider test devices before resale or donation?
How does it handle damaged batteries and unsupported models?
What happens when a phone cannot be securely erased?
Finally, ask how the provider distinguishes reusable equipment from regulated waste.
Can a company suffer a GDPR breach from disposing of a phone incorrectly?
Potentially, yes.
For example, an organisation might release a handset containing accessible personal information to an unauthorised person.
Depending on the circumstances, that could constitute a personal data breach.
However, not every device-disposal mistake automatically requires a report to the ICO.
When does the 72-hour rule apply?
UK GDPR requires organisations to report certain personal data breaches without undue delay and, where feasible, within 72 hours of becoming aware of them.
The reporting requirement depends on the risk to individuals’ rights and freedoms.
For example, a device containing sensitive unprotected personal information may create a different level of risk from a phone whose data has been effectively sanitised.
Organisations must also keep records of personal data breaches, even when notification is not required.
Read the ICO’s personal data breach guidance.
How documented erasure helps
Device-level processing records can provide relevant evidence during an investigation.
For example, a company may need to establish whether a particular handset completed erasure before it left organisational control.
However, the organisation must assess the full circumstances, not simply whether a certificate exists.
Therefore, clear asset records, suitable erasure methods and documented exception handling all matter.
Business phone recycling checklist for IT managers
Before releasing a batch of retired smartphones, check that your organisation can answer the following questions.
Device identification and ownership
- Have we identified every handset by IMEI, serial number or asset ID?
- Do we know which devices belong to the organisation?
- Have we checked relevant lease, finance and management restrictions?
Data security and sanitisation
- Have we retained any required business information?
- Have we selected appropriate erasure methods?
- Can we distinguish completed erasures from exceptions?
- Do we have suitable evidence for the devices processed?
Reuse and recycling
- Have we established which handsets remain suitable for reuse?
- Have we tested devices intended for resale or donation?
- Have we classified genuine electrical waste appropriately?
- Are the receiving organisations authorised for the activities involved?
Final reporting
- Can we reconcile the final results against the original inventory?
- Do we have appropriate transfer and disposal records?
- Have we documented unresolved devices and assigned follow-up actions?
Businesses can adapt this checklist to their own security policies, contracts and regulatory requirements.
The verdict: secure business phone recycling starts with the data
Retiring company smartphones should not mean choosing between information security and responsible reuse.
With an appropriate process, many devices can be prepared for another user while sensitive information remains protected.
However, businesses need to account for every handset and investigate exceptions rather than assuming that all devices are safe to release.
UK GDPR, the NCSC’s sanitisation guidance and relevant environmental rules all provide important considerations.
Meanwhile, the government’s IT Reuse for Good Charter encourages organisations to think about the wider value of suitable retired equipment.
For ITAD providers, refurbishers and recyclers, professional erasure software can help bring greater consistency to these activities.
MobiWIPE offers supported Apple and Android erasure workflows, PDF certificates, multi-device processing and reporting features.
For organisations handling larger volumes, that makes it worth evaluating as part of a secure, documented mobile-device retirement process.
Make business phone recycling easier to manage with MobiWIPE
Does your organisation retire, recycle or refurbish company-owned smartphones?
MobiWIPE provides professional data-erasure workflows for supported Apple and Android devices, with certification and reporting designed for organisations that handle previously owned handsets.
Why consider MobiWIPE?
- PDF certificates documenting erasure activity.
- Support for simultaneous device processing.
- Apple and Android compatibility across supported models.
- Exception alerts for relevant processing issues.
- Reporting across users and locations.
- ADISA-approved application, as described by MobiCode.
- Volume-based pay-as-you-go commercial options.
Contact MobiCode to discuss supported devices, certification scope, approval details, processing volumes and current pricing.
Account for every device. Erase data appropriately. Record the result. Prepare suitable phones for another life.
Frequently asked questions about business phone recycling
Secure disposal of company phones
How should a business dispose of old mobile phones?
A business should identify its devices, confirm ownership, preserve necessary information and choose appropriate data-erasure methods. It should then record processing results, assess phones for reuse and use authorised waste-management routes where relevant. Requirements depend on the devices, information and activities involved.
Can a company sell old employee phones?
Generally, a business can sell devices it lawfully owns, subject to relevant contractual, data-protection and other requirements. Before transfer, it should remove business information appropriately and resolve account or device-management restrictions. The organisation should also assess whether the equipment is suitable for reuse.
Is factory resetting a company iPhone enough?
A correctly completed manufacturer erase may provide effective data sanitisation on a modern encrypted iPhone. However, the organisation must consider the device, information sensitivity, erasure result and its own security requirements. A failed or incomplete erase requires investigation.
GDPR and mobile data-erasure certificates
Does GDPR require a certificate of data erasure?
UK GDPR does not impose one universal erasure-certificate requirement for every retired smartphone. However, organisations must apply appropriate security measures and demonstrate accountability. Device-level certificates can support those responsibilities, particularly in commercial recycling contracts and audits.
What is a phone data-erasure certificate?
A phone data-erasure certificate documents an erasure activity associated with a particular handset. Depending on the software, it may contain device identification, processing details, the method used and the result. A certificate supports an audit trail but does not alone guarantee legal compliance.
Can incorrect phone disposal cause a GDPR breach?
Potentially, yes. If a device containing accessible personal information is released to an unauthorised person, the organisation may need to assess whether a personal data breach occurred. Reporting requirements depend on the risks involved, and not every incident is automatically reportable to the ICO.
WEEE, ITAD and MobiCode software
Are old company smartphones classed as WEEE?
Not automatically. The classification depends on whether the handsets meet the criteria for legitimate reuse or have become waste. Equipment classed as WEEE must follow the relevant waste-management requirements. The Environment Agency publishes detailed guidance on the distinction.
What is an ITAD provider?
An IT asset-disposal provider helps organisations manage technology that has reached the end of its intended business use. Services may include collection, asset tracking, data erasure, testing, refurbishment, resale and appropriate waste disposal, depending on the provider’s capabilities.
What is MobiWIPE?
MobiWIPE is MobiCode’s professional mobile data-erasure software for supported Apple and Android devices. It provides simultaneous device-processing capabilities, PDF erasure certificates, exception alerts and management reporting for business users.
What is the difference between MobiWIPE and MobiONE?
MobiWIPE focuses on secure mobile data erasure and related certification. MobiONE supports a wider device-processing workflow involving checking, diagnostics, grading and erasure. Businesses should choose based on their device volumes and operational requirements.
Sources and further reading
UK government guidance on device reuse
GOV.UK — IT Reuse for Good Charter Guidance
Updated 2 October 2026. Official guidance on reuse-first IT asset management, secure device preparation and responsible donation.
Data security and GDPR
National Cyber Security Centre — Secure Sanitisation and Disposal of Storage Media
UK technical guidance covering data sanitisation, encryption, manufacturer reset functions, reuse and disposal. Reviewed February 2025.
National Cyber Security Centre — Decommissioning Assets
Guidance on preparing equipment for reuse, sale, repair or disposal.
Information Commissioner’s Office — Keeping IT Systems Secure
ICO advice on secure device disposal, access controls and protecting organisational information.
ICO — Disposal and Deletion Audit Framework
Guidance on secure disposal methods, documented controls and equipment awaiting destruction.
ICO — Personal Data Breaches: A Guide
Official guidance on incident assessment, recording and applicable breach-notification duties.
WEEE regulations and waste disposal
Environment Agency — When Electrical Equipment Becomes Waste
Official criteria for distinguishing reusable electrical equipment from regulated waste.
GOV.UK — Business Waste Transfer Notes
Requirements for relevant non-hazardous waste transfers, documentation and retention.
Environment Agency — Waste Carrier, Broker and Dealer Registration
Registration guidance for relevant waste-related business activities in England.
GOV.UK — Waste Duty of Care Code of Practice
Responsibilities for waste producers, carriers, dealers and brokers.
MobiCode business software
Professional mobile data erasure, PDF certificates, multiple-device processing, exception alerts and reporting.
Wider mobile device processing, diagnostics, custom grading and data-erasure workflows.
Product demonstrations, supported-device information and commercial enquiries.