At a glance
A factory reset alone isn’t enough — done out of order, it can still leave your UPI ID, registered mobile number, and cached banking-app data recoverable on the device. The right sequence: deregister UPI and log out of every banking app first, remove your Google or Apple account, take out the SIM and SD card, then run the actual reset (with encryption on Android) as the last step, not the first.
Educational resource only. This is a practical guide to clearing personal data — Aadhaar, PAN, UPI and app logins — from a phone before selling or handing it down in India, in line with the safe-handling ideas behind India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
Why a factory reset alone isn’t enough
A reset wipes the file system, but a UPI ID or an active app session isn’t just a file — it’s a live registration tied to your number, and skipping the earlier steps can leave it exposed. Your UPI apps store your registered mobile number, linked bank accounts, and transaction shortcuts; your banking apps may cache login tokens that survive a careless reset if the app itself wasn’t logged out first. A phone handed over without going through the full sequence below can still hint at your accounts, even to a buyer who isn’t specifically trying to dig them out. Treat the reset as the last step of a process, not the whole process.
Step 1: Deregister UPI and log out of banking apps
Do this before anything else — a UPI ID left registered to the device is the single biggest risk.
- Open each UPI app (Google Pay, PhonePe, Paytm, your bank’s own app) and go to its account or profile settings.
- Remove or deregister your UPI ID and unlink the bank account from that device.
- Log out of the app completely — don’t just close it.
- Repeat for every banking, wallet, and lending app on the phone, including ones you’ve stopped using.
- Clear each app’s cached data from your phone’s app-settings screen, so login tokens don’t linger after logout.
Step 2: Remove your accounts
Your Google or Apple account is what re-links a “wiped” phone back to your identity if it isn’t removed properly.
- Android: Settings → Accounts → select your Google account → Remove account. Also sign out of DigiLocker, email, and any cloud-backup apps individually.
- iPhone: Settings → [your name] → sign out of Apple ID, and turn off Find My iPhone — a phone still tied to Find My can be remotely locked against the new owner, or worse, its data trail still points back to you.
- Both: sign out of any password manager, and check for accounts synced within individual apps (a note-taking app, a cloud-storage app) that a whole-device account removal doesn’t touch.
Step 3: Take out the SIM and SD card
These aren’t wiped by a factory reset — they’re separate physical storage, and often still hold real data. Your SIM card is tied to your registered mobile number (which is what your UPI and banking apps authenticate against); an SD card can hold years of photos, documents, and app data the phone’s internal reset never touches. Remove both before you go any further, regardless of whether you plan to reuse them.
Step 4: Do the actual reset
Only after Steps 1–3 are done should you run the reset itself — and encryption is what makes it final.
- Android: Settings → System → Reset options → Erase all data (factory reset). On most modern Android phones storage is encrypted by default, which is what makes a factory reset actually unrecoverable — the encryption key is destroyed along with the wipe, not just the file pointers.
- iPhone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. This is the equivalent full wipe; do it only after Apple ID sign-out is confirmed.
One more check before you hand it over
A quick look after the reset catches what a rushed process misses. Power the phone back on and confirm it boots to the initial setup screen (a language/region prompt), not your home screen or a lock screen asking for your PIN. If it asks for your Google or Apple credentials to proceed, the account removal in Step 2 didn’t fully take — stop and redo it before handing the phone over.
Selling through a buyback or trade-in service
A buyback platform’s own data-wipe process is a real second layer of protection, but it’s a supplement to your own steps, not a replacement for them. The larger Indian buyback services do run genuine erasure processes on devices they collect — typically a multi-pass software overwrite of the storage (not just a simple delete), a factory reset performed again at their end during pickup or at the warehouse, and increasingly a device-level tracking system that logs every step performed on that specific unit before resale. Some claim compliance with recognised data-sanitisation standards, and a multi-point quality check that confirms the wipe completed before the phone is resold. That’s a genuinely useful backstop — but it’s still a backstop, not a substitute for Steps 1–4 above: their process starts once the phone is in their hands, after transit, after their pickup staff has already handled it, and after whatever state you left it in. Doing your own deregistration and account removal before handover means the phone is already clean the moment it leaves your hands, rather than depending on a third party’s internal process working exactly as advertised.
What about tablets and laptops?
The same sequence applies with device-specific adjustments — tablets and laptops carry the same categories of risk, just distributed differently. A tablet without cellular service won’t have a SIM or a UPI registration tied to it directly, but it very likely has the same signed-in banking apps, cloud-storage sync, and saved passwords a phone does — the account-removal and app-logout steps matter just as much. A laptop adds browser-saved passwords and autofill data (card numbers, addresses) as its own category worth clearing separately, plus any locally-saved documents — tax returns, scanned IDs — that a phone-focused checklist wouldn’t think to mention. For a laptop, sign out of the browser profile and clear saved passwords/autofill in addition to the account-and-reset sequence, and check for a full-disk encryption option (BitLocker on Windows, FileVault on Mac) to make the eventual factory reset or drive wipe as final as an encrypted Android reset is.
Don’t forget what’s backed up in the cloud
A factory reset clears the device — it does nothing to a backup copy already sitting in Google Photos, iCloud, or a WhatsApp cloud backup tied to the same account. This isn’t really a “before you sell” step so much as a “don’t assume the reset covers everything” reminder: your photos, documents, and chat history likely live on in the cloud account you signed out of in Step 2, on whatever other devices are signed into that same account, completely unaffected by what happens to the physical phone. That’s not a problem to fix before selling — it’s simply worth knowing that “I reset the phone” and “I deleted this data everywhere” are two different claims, and only the first one is what this guide actually delivers.
FAQ
Is a factory reset alone enough before selling a phone?
Not reliably. Deregister UPI and log out of banking apps, and remove your Google/Apple account, before you reset — doing the reset first can leave live registrations and cached logins that a wipe doesn’t fully clear.
Do I need to remove the SIM and SD card if I’m doing a factory reset anyway?
Yes — a factory reset wipes the phone’s internal storage, not a removable SIM or SD card. Take both out regardless of how thorough the reset is.
What happens if I forget to deregister my UPI ID?
The UPI registration stays tied to your mobile number on that device until you deregister it from within the app — a factory reset doesn’t automatically undo it, since it’s a server-side registration, not just a local file.
How do I know the reset actually worked?
Power the phone on afterward and confirm it goes to the initial setup screen, not a lock screen or login prompt. If it asks for your old account credentials, the reset or account removal didn’t fully complete.
If a buyback service promises a certified data wipe, do I still need to do my own steps first?
Yes — their process is a genuine additional layer, but it starts only once the device is in their hands. Doing your own deregistration and account removal beforehand means the phone is already clean the moment it leaves you, rather than depending entirely on their process.
Does resetting my phone delete the photos and chats also backed up to the cloud?
No — a device reset only clears the phone itself. Anything already backed up to Google Photos, iCloud, or a cloud chat backup stays in that account, on any other device signed into it, regardless of what happens to the phone you’re selling.