Every time an employee leaves a company — whether through resignation, termination, or retirement — there is a window of risk. During that transition period, sensitive company data on their mobile device, laptop, or tablet could be accessed, copied, or leaked. For IT departments, ensuring that corporate data is properly wiped from devices during offboarding is not just good practice — it is often a legal requirement under data protection regulations like GDPR, HIPAA, and CCPA.
The Growing Challenge of Mobile Device Management
The proliferation of smartphones and tablets in the workplace has dramatically expanded the surface area that IT departments must manage. A single employee might carry a company-issued phone, a personal tablet with work email, and a laptop with access to sensitive databases. The BYOD (Bring Your Own Device) trend, where employees use personal devices for work purposes, further complicates the picture. When an employee leaves, IT needs to ensure that corporate data is removed from their device without destroying their personal data — a delicate balance that requires careful planning and the right tools.
Mobile Device Management (MDM) platforms have become essential for organizations of all sizes. Solutions like Microsoft Intune, VMware Workspace ONE, and Google Workspace MDM allow IT administrators to remotely manage, monitor, and wipe corporate data from employee devices. These platforms typically support containerization, which separates corporate data from personal data on the same device, enabling selective wiping that removes only work-related information while leaving personal apps and data intact.
Creating an Effective Offboarding Policy
The foundation of effective corporate device wiping is a comprehensive offboarding policy that is established before any employee leaves. This policy should clearly define which devices are covered, what data must be wiped, the timeline for wiping, and who is responsible for executing the wipe. It should also address scenarios where employees are unreachable — for example, if someone is terminated and refuses to cooperate with device return.
Your offboarding policy should be part of a broader information security policy that employees acknowledge when they join the organization. This ensures that every team member understands their obligations regarding company data from day one. The policy should specify that employees must not attempt to circumvent device management tools or remove corporate profiles from their devices before the official offboarding process is complete. Violations of these policies should have clearly defined consequences.
BYOD Considerations and Selective Wiping
BYOD policies introduce unique challenges for corporate data wiping. When an employee uses their personal phone for work, you cannot simply factory reset the entire device — that would destroy their personal photos, messages, apps, and data. Instead, you need selective wiping capabilities that remove only the corporate container, email accounts, work apps, and company data while leaving everything else untouched.
The effectiveness of selective wiping depends on how well corporate data is isolated from personal data. Containerization technologies create a virtual boundary between work and personal environments on the same device. Corporate email, files, and apps exist within this container, and wiping the container removes all corporate data without touching anything outside of it. When implementing BYOD policies, invest in robust containerization solutions and test them thoroughly before rolling them out to employees.
Handling Unreturned Devices
One of the most challenging scenarios in corporate device management is when an employee leaves without returning their device. This happens more often than IT departments would like — particularly in cases of involuntary termination. In these situations, remote wipe capabilities are essential. If the device is connected to the internet, IT can initiate a remote wipe that erases all corporate data (or the entire device, depending on the scenario) without any physical access to the hardware.
For situations where remote wiping is not possible — the device is powered off, disconnected from the network, or the remote wipe capability has been disabled — organizations need contingency plans. This might include revoking access to all corporate systems through identity and access management tools, ensuring that the former employee cannot authenticate to any company service even if they still have a device with cached credentials. Services like CleanSlate provide straightforward remote wipe capabilities for Android devices, offering a simple solution for IT departments managing device offboarding. Learn more on our features page.
Documentation and Compliance
Every device wipe should be documented as part of your compliance records. Record the date and time of the wipe, the device model and serial number, the method used (full wipe or selective), the IT staff member who performed the wipe, and confirmation that the wipe was successful. This documentation is critical for demonstrating compliance during audits and can protect the organization in the event of a data breach investigation. Data protection regulators expect organizations to prove that they have taken appropriate measures to protect personal and corporate data, and thorough documentation of device wiping practices is a key part of that proof.