Laptops and servers tend to dominate the conversation around end-of-life data security, but company-owned smartphones and tablets carry exactly the same risk and are frequently handled with far less rigour. A device that has held corporate email, authentication apps, messaging history and cached documents deserves the same disciplined approach as any other piece of retired IT equipment.

Modern mobile operating systems have improved data protection considerably, particularly where full-disk encryption is enabled by default and a factory reset is combined with the removal of the encryption key, which effectively achieves cryptographic erasure. This is genuinely more secure than it was a decade ago. The gap businesses fall into is assuming this protection is automatic and universal, when in practice it depends on the device having encryption properly enabled, the reset being allowed to complete fully without interruption, and the device not having removable storage that bypasses the built-in reset process entirely.

Older devices, budget Android handsets without full-disk encryption enabled by default, and any device with a removable SD card present a materially higher risk. A reset on the device itself may leave a removable card entirely untouched, still containing photos, documents or cached data, and simply overlooked because it is a small, easily missed component during collection.

Account and enterprise mobility management deregistration is a separate but related step that is often missed. A device wiped locally but still enrolled in a mobile device management platform, or still linked to corporate accounts, can leave configuration profiles, access tokens or synced data recoverable through the associated cloud account rather than the physical device itself — meaning mobile data sanitisation needs to cover both the device and its account associations, not the hardware alone.

For businesses building or reviewing a mobile device offboarding policy, the practical steps are straightforward: confirm encryption is enabled before a device is ever issued, not only at disposal; deregister devices from any mobile device management or enterprise mobility platform before or during the wipe process; physically check for and separately sanitise any removable storage; and apply the same verified, certified erasure standard to mobile devices as to laptops and servers, rather than treating a standard factory reset as sufficient without confirmation.

Given how routinely mobile devices are replaced compared with laptops — often on shorter refresh cycles — this is an area where a small policy gap can generate a disproportionate volume of risk over time if it is not addressed directly.