0

I've been using devices belonging to the company, but provided to me for work - for personal purposes also (phone/notebook) - as agreed with IT department and manager. Since now I'm leaving the company I naturally have to return all my devices but I'm worried that some of my personal information will remain in the system so I've decided to erase it (factory reset the device).

Since there is no mention of such an action in the contract, I'd like to ask here if there are any general rules and if it may cause some problems or not - maybe admin has to reset the device anyway before passing it to someone else? Does anybody have better insight into this problem? Sure I can ask our admin but that's the last option for me.

6
  • 10
    Ask the admin anyway. It is your last option, but should be your first since 'general rules' do not apply to your specific situation. Any advice we give here can be overruled by your corporate policies.
    – Jeroen
    Nov 29 '21 at 10:01
  • Are there any kinds of company data on the devices that are not stored on servers? If yes, save that! Nov 29 '21 at 10:44
  • 4
    If these devices are being backed up by your company in some way, factory resetting them won't ensure that your personal information is no longer in the company's systems.
    – sf02
    Nov 29 '21 at 14:22
  • 1
    There are really separate issues that you're confusing. In practice, it's quite likely they won't care (they'll re-image devices or whatever). But there may be legal principles around data retention/destruction, and may be corporate policies; we know nothing about what laws apply or what your company's policies are. In some countries you may even have a right to privacy at work (e.g. in Germany).
    – Stuart F
    Nov 29 '21 at 15:22
  • 1
    This is why I always keep tabs on what personal data I give my work laptop access to. Next time ask yourself 'would I be happy if IT took my machine away from me now?', if the answer is a flat 'no', then work to ensure that it's kept in a state that you would be happy 👍. Nov 29 '21 at 18:33
15

I'd like to ask here if there are any general rules

The general rule is to just delete your personal data and don't touch what belongs to the company. Depending on what is on the device a factory reset can cause extra work for the IT. Things like apps, update and licences may need to be rebuilt.

The other general rule is that if you're going to modify company IT equipment, you consult the company IT.

8

Another way to phrase this question would be: can I delete all the company data on the company-owned devices that I've been using?

Unless you get written confirmation that it is OK to do this, I would strongly advise against it, because you could potentially be destroying company records and data.

You wouldn't just decide to shred all of the documents and company information in your desk and filing cabinet when leaving - doing so on a mobile device or laptop shouldn't be any different.

4

Not using Company machines for personal data is by far the best option.

However you did, so now you have to check with IT before you do a reset.

If you reset then they may, or may not bother, be able to recover costs from you to rebuild the device. If they completely reset devices as part of their standard policy when re-issuing devices then it won't be an issue. But if they only remove the minimum then that may be a problem.

2

In the absence of an electronic media usage policy, and as your contract does not state otherwise, I would say you did nothing prohibited, provided you took steps to save company data. If there is one, you should follow it, since it is supposed to regulate these matters.

I would still explain the situation to the manager/IT department. A factory reset to avoid handing over a device with personal data should be a reasonable course of action. You should however have done this prior to resetting the devices.

Beware of another separate issue comes into play: company owned data. Any relevant company data contained on those devices should be properly stored or handed over prior to resetting. If not, this could be a serious issue. What company data should be saved and where? Either there is a record retention policy, or make a compilation of what is saved on the device and let your manager decide.

Because you already resetted the devices, you now have to persuade the company that you indeed took the steps to ensure the data is saved elsewhere.

0

I wouldn't.

Most companies have their own image that takes hours to build.

Delete what you can of your personal data, and don't worry about it. With my company, it is a security precaution. Every returned computer is re-imaged, and all previous data is removed.

The company protects itself in two ways:

  • They destroy any personal data of the previous owner, and protect themselves from liability for any of that data getting out into the wild.
  • They wipe it and put a fresh image to get rid of any malware.

This is pretty standard, but if you feel the need, just ask if your IT department will re-image the machine once it is returned

Not the answer you're looking for? Browse other questions tagged .