What to do if…
you are told your work devices will be remotely wiped and you still need personal data off them
Short answer
Contact your IT/service desk immediately and ask for a short hold (or a supervised window) to export only your personal items in a way that complies with policy. Do not try to bypass security controls or “rush-copy” mixed work content.
Do not do these things
- Do not copy work/confidential files “just in case” alongside your personal items.
- Do not email files out, sync to personal cloud storage, or plug in personal USB drives unless IT explicitly approves it.
- Do not disable device management (MDM), tamper with security settings, or try to “block” the wipe.
- Do not wipe/reset the device yourself or delete logs/messages to “tidy up”.
- Do not assume you can get things back after the wipe (a wipe is designed to make recovery difficult or impossible).
What to do now
- Capture the essentials (fast, factual). Note exactly which device(s), the deadline/time, and whether it’s a full wipe or a work-profile/managed-data wipe. Take a clear photo/screenshot of the notice for your records.
- Write a tight list of what you’re trying to save. Keep it defensible and clearly personal (for example: personal photos, personal contacts stored locally, personal browser bookmarks, personal documents you created, personal certificates). Avoid anything that could be work product.
- Ask IT for a compliant export method — and propose one. Request:
- a brief delay (even 30–120 minutes can matter),
- a supervised export of named folders/apps (e.g., “Pictures/Personal”, “Downloads/personal”, browser bookmarks export),
- delivery via an approved route (e.g., IT-provided encrypted USB, secure transfer link, or another method your employer permits).
- Secure your personal accounts before you lose access. If personal accounts were used on the device:
- sign out where you can,
- change passwords from a separate trusted device,
- remove the work device from your account’s “trusted devices/sessions”. If the device was used for 2-factor codes or password storage, make sure you have recovery access (backup codes/alternate method) before the wipe.
- Download key employment documents from official systems (not the device drive). While you still can, use HR/self-service portals to download copies you may need later (for example: payslips, P60/P45, contract/offer letter, benefits/pension documents, training certificates, performance reviews) where your employer’s systems allow it.
- Put your request in writing, calmly. Even if you call first, send a short email/ticket reply: the personal items you need, the wipe deadline, and that you’re requesting a supervised/policy-compliant export. Avoid arguments; keep it practical.
- If you’re blocked and it’s genuinely your personal data, consider a UK GDPR “subject access request” (SAR). You can ask for a copy of your personal data the organisation holds (commonly HR/payroll/employee records). Be specific (your identifiers, date ranges, and which systems/teams likely hold it). Responses are typically required without undue delay and usually within a month, but can take longer in some situations.
What can wait
- You do not need to decide today whether to raise a grievance, resign, or take legal action.
- You do not need to write a long explanation or defend your whole employment history right now.
- You do not need to perfectly organise files — focus only on the few personal items you truly cannot replace.
Important reassurance
It’s common for people to have a small amount of personal material on work devices. Remote wipes are often routine security/offboarding measures. A narrow request for a supervised, policy-compliant export of personal items is reasonable — and acting quickly and calmly improves your chances.
Scope note
These are first steps to prevent irreversible loss and avoid making the situation worse. If this is tied to a disciplinary/termination dispute or allegations, independent employment advice can help you avoid accidental missteps.
Important note
This is general information, not legal advice. Workplace device rules vary by employer and contract/policy. Even if your intent is “just personal files”, trying to bypass controls can be treated as misconduct — keep your request narrow, written, and routed through IT/HR.
Additional Resources
- https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
- https://www.gov.uk/data-protection/find-out-what-data-an-organisation-has-about-you
- https://www.gov.uk/personal-data-my-employer-can-keep-about-me
- https://www.ncsc.gov.uk/collection/device-security-guidance/managing-deployed-devices/erasing-devices
- https://www.acas.org.uk/