In this guide · 8 sections
- 01Why deleting files is not enough
- 02Factory reset vs crypto erase vs physical destruction
- 03How to wipe a laptop, Mac or phone before selling
- 04Printers, copiers, NAS and other forgotten storage
- 05Recycling e-waste in Singapore and certificates of destruction
- 06Selling, donating or returning leased equipment
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Back up what you need, sign the device out of every account, then erase it with encryption on (factory reset on phones and Macs, Reset this PC with data cleaning on Windows). If a drive cannot be wiped, have it physically destroyed and keep the certificate.
Why deleting files is not enough
Dragging files to the bin, or even formatting a drive, usually leaves the data recoverable with free tools. Personal data on an old office laptop (customer lists, payslips, NRIC scans, saved browser passwords) is exactly what ends up in a data breach case when a device is sold or thrown away.
The PDPC's Guide to Data Protection Practices for ICT Systems (revised July 2026) lists two basic practices: before redeploying, exchanging or disposing of any hardware, make sure all personal data is securely wiped, sanitised or destroyed, for example by cryptographic erasure; and when disposing of hardware, use secure methods such as physically destroying, degaussing or shredding drives. It also asks organisations to keep an asset inventory that includes disposals.
Factory reset vs crypto erase vs physical destruction
There are three levels of making data unrecoverable. The right one depends on the device and how sensitive the data was. NIST's SP 800-88 Revision 2 (September 2025) is the reference most IT teams and recyclers use for these methods.
| Method | What it does | Use it for |
|---|---|---|
| Factory reset with encryption on | Deletes the encryption key, so old data cannot be decrypted (crypto erase) | Modern phones, Macs, BitLocker PCs you will sell or donate |
| Overwrite or vendor secure erase | Writes over the whole drive or runs the drive's built-in sanitise command | Unencrypted drives you want to reuse |
| Physical destruction | Shreds, crushes or drills the storage | Failed drives, very sensitive data, devices that will not boot |
Crypto erase is quick and reliable, but only if the drive was encrypted the whole time. If a Windows laptop never had BitLocker turned on, turn it on and let it finish before resetting, or treat the drive as unencrypted. Our guide to turning on BitLocker and FileVault explains how to check.
How to wipe a laptop, Mac or phone before selling
Follow this order for each device. Skipping the account steps is the most common reason a buyer or recycler ends up with a locked device, or a business finds its data still synced.
Back up and move the user's files
Copy anything still needed to OneDrive, Google Drive or SharePoint. Check the desktop, downloads folder and any local email archive (.pst files).
Sign out of accounts and remove from management
Sign out of Microsoft 365, Google, iCloud and password managers. Remove the device from Intune or your MDM, and from Apple Business Manager or Windows Autopilot if you are selling it.
Windows: Reset this PC and remove everything
Go to Settings > System > Recovery > Reset PC, choose Remove everything, and turn on the option to clean the drive. On a BitLocker-encrypted drive this also discards the old key.
Mac: Erase All Content and Settings
On Macs with Apple silicon or a T2 chip, use System Settings > General > Transfer or Reset > Erase All Content and Settings. It removes the user data and the encryption keys and signs out of Apple accounts.
iPhone: Transfer or Reset iPhone
Apple's sell or give away guide says to sign out of iCloud, then erase all content and settings, which also removes Activation Lock.
Android: remove Google accounts, then factory reset
Google's reset your old Android device steps: remove each Google account under Passwords and accounts, then System > Reset options > Erase all data. Otherwise factory reset protection blocks the next user.
Record it
Write down the serial number, method used, date and who did it. Update your asset list.
Printers, copiers, NAS and other forgotten storage
Laptops and phones are the obvious ones. The devices that cause surprises are the ones nobody thinks of as computers.
- Office printers and multifunction copiers: many keep scanned and printed jobs on an internal drive or memory. Use the manufacturer's data overwrite or initialise-all-data function, or ask the leasing company for a disk wipe certificate when you return the unit. Our office printer security guide covers the settings.
- NAS boxes and old servers: use the NAS's secure erase option on each disk, or remove the disks and have them destroyed. RAID disks hold data even when removed from the box.
- USB drives, SD cards and external hard disks: cheap to destroy, hard to verify after wiping. Physical destruction is often simplest.
- CCTV recorders, POS terminals and tablets used at reception: they hold customer images, payment logs or sign-in records.
- Routers and firewalls: reset to factory settings so saved Wi-Fi passwords and VPN details are removed.
Recycling e-waste in Singapore and certificates of destruction
Once data is handled, recycle the hardware properly. NEA's where to recycle e-waste page lists the collection points under the e-waste Extended Producer Responsibility scheme run by ALBA E-Waste, including 3-in-1 bins for ICT equipment, batteries and lamps, in-store counters, and ALBA's depot.
For data-bearing devices, ALBA launched ALBA Secure-Recycle: drop phones, tablets and laptops at Pick! lockers or SPX service points, track the device until it is recycled by an NEA-licensed recycler, and receive a Certificate of Destruction listing details such as brand, model and IMEI. It was announced in October 2026 as a six-month pilot, so check the page for current eligibility. ALBA's data security page still recommends erasing your data before you drop a device off.
Disposal record for each device
Selling, donating or returning leased equipment
Reselling old laptops to staff, donating to a charity, trading in phones at a telco shop or returning leased PCs all count as handing over the storage. Treat each one the same way: wipe first, record it, then hand over.
If a vendor or recycler wipes the device for you, they are handling your data on your behalf. Ask what method they use, whether they will issue a per-device certificate, and how long devices sit in storage before processing. For staff who are leaving, combine this with the account steps in our employee offboarding IT checklist.
Do it yourself or get help?
A handful of modern, encrypted laptops and phones can be wiped in-house using the steps above. The time goes into checking accounts, MDM records and the devices nobody remembers.
Our Device Encryption & Management package (S$490) puts every laptop under management with encryption and an asset list, which makes retiring devices quick and provable. For a one-off job such as wiping a few machines or a NAS, book a Quick Fix (S$119 for one hour).
Frequently asked questions
On a laptop whose drive was encrypted with BitLocker or FileVault the whole time, a full factory reset that removes everything is generally enough, because it discards the encryption key and leaves the old data unreadable. On an unencrypted drive a quick reset may leave recoverable data, so choose the option that cleans the drive, run a full overwrite, or destroy the drive.
The PDPA requires reasonable security arrangements to protect personal data, and organisations should stop keeping personal data once it is no longer needed. The PDPC's guide on data protection practices for ICT systems recommends securely wiping, sanitising or destroying personal data before disposing of hardware, such as cryptographic erasure or physically destroying drives, and keeping an asset inventory.
NEA lists collection points under the e-waste Extended Producer Responsibility scheme run by ALBA E-Waste, including bins for ICT equipment, in-store counters and ALBA's depot. For data-bearing devices, ALBA also runs Secure-Recycle with a certificate of destruction. Larger volumes can go to NEA-licensed e-waste recyclers, many of which offer collection and data destruction services.
It is a document from the recycler or data destruction company confirming that specific devices or drives were destroyed or wiped, usually with serial numbers or IMEI, the method and the date. Keep it with your asset records. It helps show you handled personal data responsibly if a question ever arises about a lost or resold device.
Many office printers and multifunction copiers keep copies of scanned, faxed or printed jobs on an internal drive or memory, plus address books and network settings. Before returning a leased unit or recycling one, run the manufacturer's data overwrite or initialise function, or ask the leasing company to wipe the drive and provide a certificate.