What’s the right way to handle customer data / privacy on devices I repair?

Question

Occasionally customers hand me unlocked devices with personal stuff on them — photos, banking apps, etc. I’ve been paranoid about liability. What do other shops do? Do you require passcodes? Refuse to take unlocked devices? Have a privacy policy customers sign?

John Admin · Accepted Answer

This is one of the most overlooked liability issues in the repair industry. Here’s what a well-run shop does: 1. Have a signed intake form — always. Every device gets a paper/digital intake form with: customer name, device model, IMEI/serial, visible condition notes, repair requested, estimated cost, and a short liability/privacy clause. No exceptions, not even for friends. The privacy clause should say something like: “I authorize [Shop] to access my device solely for the purpose of performing the requested repair. I understand [Shop] will not view, copy, or transmit personal data except as necessary to diagnose or complete the repair. I am responsible for backing up my data before service.” 2. Require a passcode only when strictly necessary. For screen/battery/port work you usually don’t need the passcode. For logic-board work, liquid damage, or anything where you must boot to the OS to verify the fix — yes, you need it. Ask them to remove any banking / sensitive apps before handing it over, or change to a temporary passcode. 3. Turn off any “Find My” / activation lock before board-level work. Document it on the intake form. 4. Never keep data. If you need to image a device for data recovery, that image lives on an encrypted, isolated drive, gets handed back to the customer on their media, and the copy on your drive gets deleted with a documented wipe — in front of them if they want. 5. Post a sign. Somewhere visible: “Our technicians do not access personal files during repair. Please back up your data before service.” It sets expectations and protects you. 6. Train staff. The fastest way to end a shop is one tech caught going through a customer’s photos. Fireable offense, in the handbook, on day one. Depending on your country/state there may be specific laws (GDPR, CCPA, HIPAA if you ever touch medical devices). Worth 1 hour with a local small-business lawyer to get your intake form right — cheapest insurance you’ll ever buy.

Danny Tran · Answer

Adding to this: for devices left unclaimed past 30/60/90 days, make sure your intake form spells out what happens — abandoned-property laws vary by state. Without that clause you can’t legally resell or recycle an abandoned device, which eats shelf space fast.