Data Erasure in Education: What You Need to Know

Overview

Let’s talk about something that doesn’t get nearly enough attention until there’s a problem: data security during device refreshes.

If you’re managing technology for a school, university, or business, you’re responsible for protecting sensitive information on every device you retire. Student records. Faculty research. Employee data. Financial information. It’s all there, and it all needs to be completely erased before those devices leave your building.

A factory reset won’t cut it. Here’s why that matters and what you should be doing instead.

Factory Reset vs. Certified Data Erasure

Most people assume that resetting a device to factory settings deletes everything. It doesn’t.

A factory reset removes the pointers to your data—think of it like removing the table of contents from a book. The book still exists. The chapters are still there. You just can’t easily navigate to them anymore. But with the right software (which is readily available), that data can be recovered.

Certified data erasure, on the other hand, actually overwrites the data multiple times using methods that meet government and industry standards. The data isn’t just hidden—it’s gone. Permanently. Unrecoverably.

This isn’t paranoia. This is compliance.

NIST Standards: The Baseline You Need

The National Institute of Standards and Technology (NIST) publishes guidelines for data sanitization—specifically NIST Special Publication 800-88. These guidelines outline how to properly erase data from different types of media.

For solid-state drives (which is what modern Apple devices use), NIST recommends cryptographic erasure or block erasure methods that ensure data cannot be recovered.

Here’s what that means in plain language: the erasure process needs to be thorough, documented, and verifiable. You need to be able to prove that data was erased properly, not just say that you did it.

Why This Matters for Schools

Schools and universities are required to protect student information under FERPA (Family Educational Rights and Privacy Act). Businesses have their own compliance requirements under various federal and state laws.

If a device leaves your organization with recoverable data on it, and that data is accessed or breached, you’re liable. The fines can be significant. The reputational damage can be worse.

But beyond compliance, there’s something else at stake: trust. Parents trust you with their children’s information. Faculty trust you with their research. Employees trust you with their personal data. Protecting that information—all the way through the device lifecycle—is part of keeping that trust.

Red Flags to Watch For

Not all buyback partners handle data erasure the same way. Here are some warning signs:

Vague language about data removal: If they’re not specific about their erasure methods, ask why
No documentation provided: If they can’t give you proof of erasure, that’s a problem
Overseas processing: If devices leave the country, you’ve lost control of the data security chain
Third-party subcontracting: If your partner farms out the work, who’s actually handling your devices?

The right partner will be completely transparent about their process, provide detailed documentation, and keep everything in-house with full accountability.

What “Done Right” Looks Like

At Second Life Mac, data erasure isn’t an afterthought—it’s the foundation of everything we do.

Every device is processed in our Skokie, Illinois facility. No third parties. No overseas partners. Complete chain of custody from pickup to processing to proof of erasure.

We follow NIST 800-88 guidelines. We provide detailed documentation for every single device. And we give you audit-ready reporting that meets organizational compliance requirements.

This isn’t just about checking a box. It’s about doing the work correctly so you can confidently tell your leadership, your board, and your community that sensitive data was handled with the seriousness it deserves.