Mobile data erasure becomes a serious business requirement when company smartphones reach the end of their first life. Before an organisation reuses, sells, refurbishes, donates or recycles an iPhone or Android device, it needs to remove the information stored on it securely — and ideally prove what happened afterwards.
Wiping one employee’s old phone is straightforward. Processing hundreds or thousands of devices across offices, recycling centres or refurbishment lines creates a very different challenge: identification, repeatability, exception handling, certification and reporting.
This 2026 guide explains what current UK and international guidance says about secure device sanitisation, what records organisations should keep, when reuse makes more sense than destruction and where professional mobile data erasure software such as MobiWIPE fits.
The short answer
A strong mobile data erasure process should identify the handset, apply an appropriate sanitisation method, verify completion, separate devices that fail the normal process and retain device-level evidence before the phone leaves organisational control.
Why mobile data erasure matters more in 2026
Organisations increasingly want to recover value from technology instead of automatically destroying or discarding it.
That trend accelerated during 2026.
On 12 August 2026, GSMA Industry Services launched Circularity Services to help mobile operators and ecosystem partners extend device lifecycles, reduce electronic waste and recover more value from existing assets.
UK policy is moving in a similar direction.
The government’s IT Reuse for Good Charter encourages organisations to take a “reuse first” approach to IT assets including smartphones.
The guidance specifically expects devices entering donation schemes to undergo secure wiping before reuse.
As of September 2026, the government listed more than 50 organisations as charter signatories, including businesses, councils, government bodies and technology organisations.
The commercial opportunity is clear: a working phone can still have resale, redeployment or donation value.
Secure mobile data erasure helps an organisation unlock that value without carrying the previous user’s information into the next stage of the device lifecycle.
A retired company phone is an asset, not automatically waste
An organisation replacing employee smartphones has several possible routes for the old devices.
A handset may become:
- another employee’s device;
- a refurbished handset;
- trade-in stock;
- a device sold through an ITAD partner;
- a donated device;
- a source of reusable parts;
- an end-of-life recycling asset.
Destroying every functioning handset removes all of those possibilities.
A controlled sanitisation process can allow suitable devices to move safely into another useful life.
What information can remain on a company smartphone?
Business phones can contain significantly more sensitive information than a simple contact list.
Depending on how employees use them, devices may hold:
- corporate email;
- customer and supplier information;
- photographs and videos;
- downloaded documents;
- Teams, Slack or other workplace messages;
- calendar information;
- browser data;
- call history;
- locally stored application information;
- authentication-related data;
- personal information belonging to the employee.
Device retirement therefore becomes a data-governance issue as well as an asset-management task.
What does UK guidance say about mobile data erasure?
UK guidance does not simply tell organisations to throw every old smartphone into a shredder.
Instead, the appropriate treatment depends on the device, its encryption state, the information involved and the organisation’s risk requirements.
NCSC guidance on erasing smartphones
The UK’s National Cyber Security Centre guidance on erasing devices covers smartphones, tablets, laptops and desktop computers.
The NCSC says organisations may need to erase devices before selling them, returning them for repair or reallocating them to another member of staff.
For modern iOS and Android devices, the NCSC recommends the appropriate manufacturer-provided erase or factory-reset process in normal situations.
It also recognises that organisations with stronger assurance requirements may need to follow more rigorous sanitisation guidance.
NCSC guidance when sensitive data has been stored
Separate NCSC secure sanitisation guidance states that media containing information sensitive to the organisation should undergo sanitisation before leaving organisational control.
The NCSC identifies four common reasons:
- reuse by another employee;
- sale or donation;
- repair or replacement;
- final disposal.
Crucially, some sanitisation methods preserve the device for reuse while others destroy the storage media.
What does the ICO expect when organisations dispose of devices?
The Information Commissioner’s Office focuses heavily on appropriate process and documentation.
Its current disposal and deletion guidance says organisations should use appropriate methods that prevent disclosure of electronic records before, during and after disposal.
The ICO warns that personal information may remain recoverable when electronic records do not undergo secure destruction. That can create issues under the security principles in UK GDPR Articles 5(1)(f) and 32.
The ICO also recommends that organisations:
- use and document secure disposal methods;
- store devices awaiting destruction securely;
- keep a log of devices awaiting destruction and their location;
- consider recording who accesses devices awaiting disposal.
That makes one point particularly important for businesses:
NIST updated its media sanitisation standard in 2025
International best practice has also changed recently.
In September 2025, the US National Institute of Standards and Technology published NIST SP 800-88 Rev. 2 — Guidelines for Media Sanitization.
The publication replaced the previous 2014 revision.
NIST defines sanitisation as a process that makes access to target data infeasible for a given level of effort.
More importantly for businesses, the new revision shifts its emphasis towards establishing an organisation-wide media-sanitisation programme rather than treating every wipe as an isolated technical action.
The current guidance focuses on areas such as:
- appropriate sanitisation methods;
- organisational controls;
- data sensitivity;
- validation;
- trust in the implementation of sanitisation techniques;
- cryptographic erase where appropriate.
That is much closer to the problem faced by a recycler, ITAD provider or corporate fleet manager processing thousands of assets.
Factory reset vs mobile data erasure: what is the difference?
A factory reset and professional data-erasure software are not necessarily competing technical concepts.
Modern smartphones use encryption extensively.
On appropriately configured modern devices, the correct manufacturer erase procedure can make stored user data inaccessible by removing or invalidating the keys required to read it.
The NCSC says the built-in restore, factory-reset or erase-all-content functionality is sufficient in nearly all ordinary cases.
The business problem is different.
A recycler processing 1,000 handsets does not only need to know that a factory reset can work.
It needs to know:
- which 1,000 devices entered the process;
- whether each handset completed it;
- which devices failed;
- whether activation or account restrictions remain;
- who handled each device;
- where the evidence sits afterwards.
Professional mobile data erasure software adds value around that operational challenge.
Why mobile data erasure gets harder at scale
Wiping one employee’s phone is easy to supervise.
Wiping 500 devices across several offices or processing centres requires a repeatable system.
At that point, organisations need answers to practical questions:
- Which devices have arrived?
- Which employee, customer or asset record belongs to each handset?
- Which devices completed erasure?
- Which devices failed?
- Which still have account restrictions?
- Who processed them?
- Which devices can now move into resale or reuse?
- Can management retrieve evidence later?
A spreadsheet and a collection of individual manual resets become increasingly difficult to control as throughput grows.
Where MobiWIPE fits into mobile data erasure
MobiWIPE is MobiCode’s secure data-erasure application for organisations processing Apple and Android devices.
MobiCode currently positions MobiWIPE for businesses handling pre-owned devices, including recyclers and corporations.
Its value is not simply the existence of an erase command. The commercial proposition combines erasure with repeatability, multi-device processing, certification, reporting and exception handling.
Process multiple devices simultaneously
MobiWIPE supports multiple simultaneous device connections.
That matters when a recycler, refurbisher or corporate IT team needs to clear a large device batch without creating a queue around one workstation.
Generate a PDF erasure certificate
MobiCode states that MobiWIPE generates a PDF certificate for erasure activity.
That gives the organisation a device-level record that it can retain or provide to a client where appropriate.
Keep central reporting
MobiWIPE activity integrates with the MobiCode reporting environment.
Management can maintain visibility across different operators and locations rather than relying on disconnected local records.
Identify exceptions
MobiWIPE highlights exceptions that can prevent the expected erasure process from completing.
MobiCode also says its wider due-diligence functionality can identify FRP, iCloud and account issues during processing.
That matters because a device that cannot follow the normal path needs investigation rather than an assumption that the wipe succeeded.
Why data-erasure certification matters
A successful technical erase and proof that an organisation carried out the erase are two different things.
For corporate customers, the second question can be commercially important.
Consider an ITAD provider processing 5,000 employee smartphones on behalf of a client.
Simply telling the customer:
is less useful than being able to say:
Reporting and certification therefore become part of the service proposition rather than merely an internal technical feature.
Who buys mobile data erasure software?
The strongest commercial use cases are organisations processing devices repeatedly or on behalf of third parties.
Typical buyers include:
- IT asset-disposition companies;
- mobile phone recyclers;
- smartphone refurbishers;
- large employers;
- public-sector organisations;
- mobile networks;
- managed service providers;
- corporate fleet managers;
- trade-in businesses;
- electronics retailers;
- insurers handling returned devices;
- organisations running employee technology refresh programmes.
Mobile data erasure for ITAD companies
ITAD providers have a particularly strong reason to build erasure evidence into their services.
They often process assets belonging to somebody else.
Their client may reasonably want to know:
- which assets the ITAD provider received;
- whether staff sanitised them;
- which devices failed;
- when the work took place;
- what happened to the devices afterwards.
Certification and reporting can therefore strengthen the ITAD offer itself.
Instead of:
the service becomes:
Corporate IT teams: connect phone wiping to employee offboarding
Employee departures create another obvious use case.
When a member of staff returns a company phone, the organisation may need to:
- confirm that the correct asset came back;
- recover required business information;
- remove corporate access;
- remove relevant user accounts;
- erase local information;
- remove activation restrictions;
- prepare the handset for another employee;
- route it for sale, donation, refurbishment or recycling.
Mobile data erasure therefore fits naturally inside the wider employee and asset-offboarding process.
Recyclers and refurbishers: avoid making wiping the bottleneck
A recycler may receive hundreds or thousands of smartphones during a short processing period.
If every handset needs sequential manual handling, the wipe stage can become a queue between intake and resale.
Multiple-device processing changes the economics.
Staff can progress several devices rather than waiting for each individual handset to finish before beginning the next one.
At scale, the benefit is not only faster erasure.
It is smoother movement through the entire refurbishment or recycling workflow.
Do businesses need to destroy every phone?
No.
Some devices should ultimately undergo physical destruction because of their condition, the sensitivity of the data or the organisation’s security requirements.
However, automatically destroying every functioning smartphone also destroys the hardware’s remaining economic value.
NCSC guidance explicitly recognises sanitisation methods that allow devices to be reused or released outside the organisation.
The appropriate decision depends on the risk.
Secure erasure can preserve substantial residual value
Imagine a company replacing 2,000 employee phones.
If many remain functional, the combined resale or reuse value can be significant.
Securely processing those handsets creates several potential routes:
- redeployment to other employees;
- trade-in;
- business-to-business resale;
- refurbishment;
- donation;
- parts recovery;
- recycling where reuse is no longer practical.
That is why the objective should not simply be “destroy the data”.
A stronger objective is:
What happens when a phone cannot complete mobile data erasure?
Not every handset will follow the normal path.
Devices may arrive:
- physically damaged;
- unable to boot;
- unstable;
- activation locked;
- account locked;
- unable to complete the required process.
A mature workflow isolates those exceptions rather than recording them as successful.
The organisation can then assess the device, its data sensitivity and the residual risk before deciding whether to attempt another sanitisation method or route the storage for destruction.
A practical mobile data erasure workflow
1. IDENTIFY
Record the device
Capture the IMEI, serial number, model and relevant employee, customer, asset or batch reference.
2. CLASSIFY
Choose the appropriate route
Decide whether the organisation intends to redeploy, resell, refurbish, donate, recycle or destroy the device.
3. ERASE
Run the approved sanitisation process
Apply the organisation’s defined erasure method to the correct physical handset.
4. VERIFY
Confirm the outcome
Confirm successful completion and route exceptions for investigation rather than assuming they passed.
5. CERTIFY
Retain the evidence
Keep the relevant processing record or erasure certificate against the device.
6. RELEASE
Move the device into its next life
Only after the required controls pass should the handset enter redeployment, resale, donation, refurbishment or recycling.
What should a mobile data erasure record contain?
Exact requirements depend on the organisation, but useful device-level evidence may include:
- IMEI;
- serial number;
- make and model;
- employee, asset or batch reference;
- processing location;
- operator;
- date and time;
- erasure result;
- exception information;
- certificate or report reference;
- final asset route.
That creates a much stronger operational record than one spreadsheet cell marked “wiped”.
Why central reporting matters for multi-site organisations
Large organisations often process devices in several locations.
That creates another consistency problem.
One site may follow the procedure closely while another gradually develops shortcuts.
Central reporting can help management monitor:
- device volumes;
- successful erasures;
- exceptions and failures;
- operator activity;
- location-level variation;
- missing processing records.
MobiCode specifically positions MobiWIPE reporting as a way to provide visibility across users and business locations.
What is the ROI of professional mobile data erasure?
Organisations sometimes ask why they should pay for software when smartphones already contain a reset button.
That misses most of the commercial value.
The better question is:
1. Reduce manual handling
Simultaneous processing can help reduce queues during larger device refreshes or recycling batches.
2. Reduce process risk
Defined workflows and exception alerts can make it harder for failed devices to move unnoticed into the next stage.
3. Improve customer and compliance evidence
Device-level records provide a stronger answer when a client, manager or compliance team asks what happened to a particular handset.
4. Recover residual asset value
Secure sanitisation can enable reuse and resale instead of automatically destroying working hardware.
5. Improve throughput
For a recycler or ITAD operation, processing time affects how quickly purchased or collected inventory can return to productive use or resale.
MobiWIPE pricing: PAYG rather than another fixed licence
MobiCode currently offers MobiWIPE using volume-based PAYG tariffs.
Its current product information says customers can access tariffs without monthly or annual commitments or locked-in licences.
That can suit businesses whose processing volume varies between large projects rather than remaining constant every month.
For example, an organisation carrying out a periodic corporate-device refresh may have very different requirements from a recycler processing phones every day.
What you are buying is more than a wipe button
Modern smartphones already contain built-in erase functionality.
Professional software needs to solve the wider business problem.
MobiWIPE’s current proposition combines:
- Apple and Android device erasure;
- multiple simultaneous device connections;
- PDF erasure certification;
- central reporting;
- exception alerts;
- FRP, iCloud and account issue detection;
- multi-user and multi-location visibility;
- ADISA-approved erasure;
- flexible PAYG pricing.
That is a substantially different operational proposition from asking an employee to reset each phone manually and update a spreadsheet afterwards.
How MobiONE extends the mobile data erasure workflow
Some businesses need to do considerably more than wipe devices.
A recycler or refurbisher may also need to establish whether a phone is commercially safe to process, run hardware diagnostics, apply a consistent grade and route exceptions.
MobiONE connects those wider decisions into a broader device-processing workflow.
MobiWIPE can then provide the secure erasure stage inside that process.
When should a business move beyond manual phone resets?
There is no universal device threshold.
However, professional software becomes increasingly valuable when:
- several employees process devices;
- the organisation handles customer assets;
- hundreds or thousands of phones need processing;
- devices move through several locations;
- management needs central reporting;
- clients expect erasure evidence;
- manual wiping creates queues;
- staff occasionally miss failed resets or account restrictions;
- the organisation wants to increase reuse rather than destroy working devices.
2026 is strengthening the case for reuse plus secure erasure
The direction of travel is increasingly clear.
GSMA’s August 2026 circularity initiative focuses on extending device life and unlocking value from existing assets.
The UK government’s reuse-first guidance encourages organisations to refurbish and redistribute suitable technology rather than treating every retired asset as waste.
NIST has modernised its sanitisation guidance around managed programmes, appropriate methods and validation.
Meanwhile, UK NCSC and ICO guidance continue to emphasise secure sanitisation and appropriate disposal controls.
Together, those developments support a straightforward lifecycle:
Do not destroy the asset simply because you need to destroy access to its data
Working smartphones can retain substantial economic and social value after their original owner no longer needs them.
The challenge is moving those devices into their next life without moving the previous user’s information with them.
MobiWIPE gives organisations processing Apple and Android devices a repeatable way to perform mobile data erasure, identify exceptions, retain certification and maintain central reporting before phones move into reuse, resale, refurbishment or recycling.
Use MobiWIPE for certificated mobile data erasure
MobiWIPE is designed for organisations that need mobile data erasure to operate as a controlled business process rather than an occasional manual task.
Current MobiWIPE features include:
- secure erasure for Apple and Android devices;
- multiple simultaneous device connections;
- PDF erasure certificates;
- centralised reporting;
- exception alerts;
- FRP, iCloud and account issue detection;
- visibility across users and locations;
- ADISA-approved erasure;
- flexible PAYG tariffs.
Retiring company phones or processing devices for customers?
Replace isolated manual resets and scattered spreadsheets with certificated mobile data erasure, multi-device processing, exception handling and central reporting.
Frequently asked questions about mobile data erasure
How should a business wipe company phones before disposal?
Businesses should identify each device, apply an appropriate sanitisation method, confirm completion, isolate exceptions and retain evidence before the handset moves into reuse, resale, refurbishment, donation or recycling.
Is a factory reset enough for a company phone?
The correct manufacturer erase process can provide effective erasure on many modern encrypted smartphones. Businesses handling devices at scale may also need verification, exception handling, certification and central reporting so they can demonstrate that each device completed the required process.
What is mobile data erasure?
Mobile data erasure is the controlled removal of user information from smartphones so that the target data becomes inaccessible before the device is reused, sold, refurbished, donated, recycled or disposed of.
What is MobiWIPE?
MobiWIPE is MobiCode’s mobile data-erasure application for Apple and Android devices. It supports simultaneous device processing, PDF certification, central reporting and exception handling for organisations managing pre-owned or retired mobile devices.
Does MobiWIPE provide a data-erasure certificate?
Yes. MobiWIPE can generate a PDF certificate for erasure activity and stores processing information within the MobiCode reporting environment.
Can MobiWIPE erase multiple phones at once?
Yes. MobiWIPE supports multiple simultaneous device connections, helping recyclers, ITAD providers and organisations processing larger device batches reduce erasure queues.
Sources and further reading
UK National Cyber Security Centre — Erasing devices
UK National Cyber Security Centre — Secure sanitisation and disposal of storage media
Information Commissioner’s Office — Disposal and deletion
NIST — SP 800-88 Rev. 2, Guidelines for Media Sanitization
UK Government — IT Reuse for Good Charter guidance
GSMA Industry Services — Circularity Services launch, 12 August 2026
MobiCode — MobiWIPE mobile data erasure
MobiCode — MobiONE device-processing workflow