A factory reset doesn’t cut it anymore. If you’re processing used phones at any real volume – buyback, trade-in, wholesale, or retail – certified data erasure isn’t optional. Buyers expect proof. Regulators expect compliance. And the standard for both is getting stricter every year.
Here’s what actually matters when choosing a data erasure solution in 2026.
Why “Factory Reset” is no longer good enough
A factory reset clears the surface. It doesn’t necessarily overwrite the underlying data and anyone with the right recovery tools can potentially retrieve what’s left behind. For personal use, that’s a manageable risk. For a reseller processing hundreds of devices per month, it’s a liability.
GDPR and CCPA both place responsibility on whoever last handled the data – including you, even if you didn’t create it. If a device you sold still contains recoverable personal data, the enforcement path leads back to your business.
Enterprise buyers and corporate trade-in programmes have moved on from taking a seller’s word for it. Documentation is now part of the deal, and “we wiped it” doesn’t qualify.
What certified data erasure actually means
Certified data erasure means the wipe was performed according to a recognised technical standard, with a verifiable record proving it happened. That’s two distinct things: the method and the evidence.
The method matters because not all wipes are equal. Overwriting data once, overwriting it multiple times, and cryptographic erasure – wiping the encryption key so data becomes mathematically unreadable – each offer different levels of assurance. The right approach depends on device type, data sensitivity and what your buyers or compliance framework requires.
The evidence matters because a wipe is only as valuable as your ability to prove it. Chain-of-custody documentation, per-device reports and exportable audit trails are what turn a technical process into a certifiable one.
Key certification standards to know in 2026
ADISA (Asset Disposal and Information Security Alliance)
ADISA is the most directly relevant certification for the used device and IT asset disposal industry. Unlike broader frameworks adapted from enterprise IT, ADISA was built specifically for organisations handling end-of-life equipment — including mobile phones. It covers:
- secure handling
- chain of custody
- verified erasure
- audit processes
And importantly, certification requires independent verification. Across the UK and Europe, ADISA is quickly shifting from a “nice-to-have” to a requirement – particularly in corporate trade-in and buyback programs.n entry requirement, not a differentiator.
NIST 800-88
NIST 800-88 remains the reference point for media sanitisation in North America.
It defines:
- clear (basic overwrite)
- purge (more thorough methods)
- destroy (physical destruction)
Even outside the US, many enterprise compliance teams still reference NIST when evaluating vendors.
DoD 5220.22-M
This is an older standard, but it hasn’t disappeared.
It still appears in:
- government contracts
- defence-related supply chains
You won’t need it every day — but when you do, it tends to be non-negotiable.
R2v3 (Responsible Recycling)
R2v3 certification focuses on responsible electronics reuse and recycling.
It requires:
- documented data sanitisation processes
- traceability
- auditability
In practice, ADISA-certified workflows often satisfy R2v3 data destruction requirements, making them complementary rather than competing standards.
Where M360 fits
M360 Diagnostics is ADISA – certified, meaning its erasure process has been independently audited and verified.
That’s not the same as “aligned.” It’s proven.
At the same time, requirements are evolving. While ADISA is becoming the baseline in Europe, standards like NIST 800-88 and frameworks like R2v3 are increasingly relevant in other markets.
M360 is actively expanding its erasure capabilities to support additional methods and align with these standards — so your process stays compliant as buyer expectations shift.
The goal isn’t just to meet today’s requirements, but to stay ahead of them.
What to look for in a data erasure solution
1, Erasure standard compliance
The solution should explicitly state which standards it meets – and where possible, hold actual certification rather than self-declared alignment. ADISA certification means an independent body has verified the process. A tool that claims to be “ADISA-compliant” without certification is making a statement nobody has validated. That distinction matters when documentation is scrutinised.
M360 Diagnostics holds ADISA certification and is actively working toward additional certifications – so the compliance credentials keep pace as buyer requirements evolve.
2, Tamper-proof audit trails and exportable reports
Every erasure event should produce a per-device report: device identifier (IMEI or serial number), erasure standard applied, method used, date and time, and result. That report needs to be exportable in a format your buyers, enterprise clients, or auditors can read and verify independently – not just visible inside the vendor’s dashboard.
3, Batch processing capability
At any meaningful scale, device-by-device manual wiping is a bottleneck. A capable solution should handle batch processing – multiple devices running simultaneously without requiring per-device operator intervention. Most refurbishers find this is where the operational return becomes obvious.
4, IMEI logging and device identification
Erasure without device identification is almost worthless for compliance purposes. The wipe record has to be tied to a specific device, not a batch reference. IMEI logging is the standard method, and it should happen automatically – not as a step someone has to remember to complete.
5, Integration with your existing workflow
A standalone erasure tool that doesn’t connect to your diagnostics, grading, or inventory system creates manual handoffs and that’s where errors and missing documentation accumulate. Look for solutions built to sit inside your existing process rather than running parallel to it.
M360 Diagnostics integrates certified data erasure directly into the device processing workflow. Test, wipe, grade, and generate a certification report in a single session without switching platforms or re-entering device data at each stage.
How erasure certification protects your business
The compliance angle is clear – GDPR enforcement actions involving personal data on sold devices are documented and ongoing. What gets less attention is the direct commercial upside.
ADISA certification is increasingly a prerequisite for selling into corporate buyback programmes and enterprise trade-in channels. Buyers in those markets aren’t just asking whether devices were wiped — they’re asking which standard was applied, whether the process was independently certified, and whether the report can be shared. Having that ready shortens deals and removes objections that otherwise stall them.
M360 Diagnostics is ADISA certified and generates exportable data erasure certification reports that give businesses documented proof of wipe for every device processed. Each report is tied to the device’s IMEI and timestamp, making it auditable and shareable with buyers, clients, or compliance teams. For operators processing used phones at scale, M360 closes the gap between performing a wipe and being able to prove it – with independently verified certification behind it, and additional certifications in progress.
That’s what separates a compliant erasure process from one that just looks like it is.
Red flags to avoid when choosing an erasure tool
No named standard. If the software doesn’t reference ADISA, NIST 800-88, or a recognised equivalent, you’re not getting certified erasure, you’re getting a wipe with no verifiable baseline.
“Compliant” without certification. Self-declared alignment to ADISA or NIST is not the same as holding certification. If a vendor claims compliance but can’t point to independent verification, treat it as unverified.
No per-device reports. A log showing “batch complete” proves nothing specific. The record has to identify the device, the standard applied, and the result per unit, every time.
Partial iOS and Android support. Some tools handle Android thoroughly but fall back on Apple’s native reset for iOS, which doesn’t meet the same documented standard. Verify both platforms are covered by the same certified process before committing.
No IMEI tie-in. Batch references without individual device identification won’t satisfy an enterprise buyer or an ADISA audit. The erasure record has to link to a specific device.
Manual-only operation. Any tool requiring an operator to confirm each wipe individually will buckle under real volume. If you’re processing more than 30–40 devices per day, automation isn’t a feature – it’s structural.
Closed, non-exportable reports. A “wipe complete” status inside a dashboard is not compliance documentation. If the report can’t be exported as a shareable file, it exists only inside the vendor’s system – which is not what ADISA or any enterprise audit process accepts.
Erasure as part of a larger refurbishment workflow
Data erasure doesn’t exist in isolation. It sits within a sequence: receive the device, run diagnostics, wipe the data, assess condition, grade it, certify it, and move it to sale. Each step produces information the next step depends on.
Tools that only handle one step force manual handoffs between systems and that’s where errors, delays, and documentation gaps build up. The more of that sequence you can run inside one platform, the more consistent and auditable your output becomes.
M360 Diagnostics allows operators to run automated diagnostics and ADISA-certified data erasure in the same processing session. Combined with batch testing, IMEI and blacklist checks, grading, and exportable certification reports, M360 covers the full device lifecycle from intake to sale-ready without juggling disconnected tools or reconciling records across platforms.
For operators with existing platform commitments, M360 integrates with partners including WholeCell and Phonilab, so data flows through the process rather than stopping at a system boundary.
The bottom line
The bar for data erasure in the used phone industry has moved. ADISA certification, GDPR compliance, and per-device audit trails are no longer differentiators – they’re the baseline serious buyers expect.
What separates a compliant erasure process from a risky one isn’t the wipe itself – it’s the evidence trail, and who verified it. Choose a solution with real certification behind it, documentation built in, and the automation to run it at scale. That’s the combination that holds up when someone asks you to prove it.
FAQ: Certified data erasure solutions for used phones
1. What is ADISA certification and why does it matter?
ADISA is a certification standard designed for organisations handling end-of-life IT equipment, including mobile devices. It verifies that data erasure processes meet strict requirements and are independently audited. For resellers, it’s increasingly required by enterprise buyers across Europe.
2. What is NIST 800-88 and how does it relate to phone data erasure?
NIST 800-88 is a widely recognised US standard for media sanitisation. It defines approved methods for securely erasing data. Many enterprise buyers and compliance frameworks reference NIST, especially in North America.
3. Is DoD 5220.22-M still relevant in 2026?
While older, DoD 5220.22-M is still referenced in certain government and defence-related workflows. It’s less common than NIST or ADISA but still appears in specific procurement requirements.
4. What is R2v3 and does it require data erasure?
R2v3 is a certification standard for electronics recyclers and refurbishers. It requires documented and verifiable data sanitisation processes. ADISA-certified workflows typically satisfy R2v3 requirements.
5. Is a factory reset the same as certified data erasure?
No. A factory reset removes user access but doesn’t guarantee data is unrecoverable. Certified data erasure follows recognised standards and produces documented proof of the wipe.
6. Does GDPR apply to used phones being resold?
Yes. GDPR applies to any personal data handled during device processing. If recoverable data remains on a sold device, liability can fall on the reseller. Certified erasure with audit documentation is the standard way to demonstrate compliance.
7. What features should data erasure software include?
Look for:
- Certified standards (ADISA, NIST)
- Per-device reporting
- IMEI tracking
- Batch processing
- Exportable audit logs
- Workflow integration
8. How does M360 handle certified data erasure?
M360 Diagnostics is ADISA certified and integrates erasure directly into the processing workflow. Each device is wiped, logged by IMEI, timestamped, and documented with exportable certification reports.
9. Can M360 generate certification reports for buyers or audits?
Yes. M360 generates per-device reports covering diagnostics, erasure, and grading. These reports are exportable and suitable for enterprise buyers, compliance audits, and certification requirements.
10. What is the best way to erase data from used phones in bulk?
The most effective approach combines:
- automated batch processing
- per-device reporting
- IMEI tracking
- certified erasure standards
