Two things go wrong when people erase a laptop before it leaves their hands, whether it’s being sold, handed to a relative, or sent back to the shop. Either they don’t erase enough and their data leaves with the machine, or they erase in the wrong order and hand over a device that’s locked to an account they can no longer reach.
Both are avoidable, and neither takes long.
“Delete the files” is not wiping
Dragging folders to the trash removes the filing entry, not the contents. Until the space is reused, the data is still on the drive and recoverable with ordinary tools.
More to the point, personal data on a modern laptop is not mostly in your documents folder. It’s in saved browser passwords, autofill addresses, payment cards, session cookies that keep you signed in, mail caches, message histories, and application data in directories you’ve never opened. Deleting the obvious files leaves nearly all of it in place.
The built-in reset on both platforms handles this properly. On any machine from roughly the last decade the storage is encrypted at rest, and the reset discards the key, which makes the remaining data unreadable regardless of what’s physically still on the drive. That’s why a modern factory reset is quick and still thorough.
Windows: Reset this PC, and the option that matters
Settings → System → Recovery → Reset this PC → Remove everything.
You’ll then be asked two things that decide whether this is actually a wipe:
Cloud download or local reinstall. Either is fine. Cloud download pulls a fresh image and takes longer; local reinstall rebuilds from what’s already on the machine.
“Change settings” → Clean data: Yes. This is the one that matters. Left off, the reset removes your files quickly but doesn’t make them hard to recover. Turned on, it takes considerably longer and does. For a machine leaving your possession, turn it on.
Two things to sort out first:
- BitLocker. If it’s enabled, either suspend it or make sure the recovery key is safely in your Microsoft account before you start (the key list lives here, and Microsoft documents the other places it can hide). A drive that ends up locked with a key nobody has is finished.
- Your Microsoft account. Sign out of it, and out of Office, OneDrive, and the Store, before resetting.
macOS: which route depends on the machine
Apple Silicon, and Intel Macs with a T2 chip: System Settings → General → Transfer or Reset → Erase All Content and Settings. This is the same mechanism as an iPhone erase: it signs you out of your Apple Account, turns off Find My and Activation Lock, discards the encryption key, and reinstalls. One operation, correct order, hard to get wrong. Use this if it’s offered.
Older Intel Macs without a T2 don’t have that option. Restart holding Command + R for Recovery, use Disk Utility to erase the internal volume as APFS, then reinstall macOS from the Recovery menu. Before you do: sign out of the Apple Account, iCloud, Messages, and iTunes/Music authorisation manually, because nothing in this path does it for you.
The locks that outlive the erase
This is the part that actually strands machines, and it’s why the sign-out has to happen before the wipe.
Activation Lock on Apple Silicon Macs is enforced below the operating system. Erasing the drive does not clear it. Apple’s own checklist for handing on a Mac walks the order. A locked machine is unusable to whoever receives it, and clearing it afterwards means proving ownership to Apple with the original purchase details.
Find My must be off. On the Erase All Content and Settings path it’s handled for you; on the Recovery path it isn’t.
Firmware or BIOS passwords survive any reinstall. Remove them first.
MDM enrollment on a work or school machine survives a standard reset and re-applies on setup. That needs the administrator to release it.
FileVault and BitLocker are only a problem if the recovery key is lost. Handled before you start, they’re a non-issue.
Stop at the setup screen
When the reinstall finishes, the machine reboots into the out-of-box setup: language selection, Wi-Fi, account creation.
Stop there. Don’t create an account, don’t sign in, don’t connect it to anything. That screen is exactly the state the next person should receive it in, and creating an account just to check it works puts you right back where you started.
Shut it down from the setup screen and pack it.
Checking you actually finished
- No account is signed in anywhere
- Find My is off; Activation Lock is cleared
- No firmware or BIOS password remains
- The drive was erased, not just emptied: Clean data on Windows, a real erase on macOS
- The machine boots to the initial setup screen
- Your backup exists and you’ve opened it once to confirm it’s real
The mistakes that come up most
Erasing before signing out. The single most common one, and the hardest to fix afterwards.
Assuming cloud sync is a backup. It syncs what you told it to sync. The Downloads folder, the desktop on some configurations, and local application data are frequently not included.
Forgetting the browser profile. Signing out of Google is not the same as removing the browser profile that holds the saved passwords and cookies. Remove the profile.
Leaving a SIM or eSIM in place on a cellular model. The physical card is obvious; the eSIM needs deleting from settings.
Doing all of this on the last day. A wipe plus reinstall can run an hour or more, and any of the locks above can turn into a support call. Leave yourself a couple of days.