Staples Caught Reselling Laptops Without Wiping Them—Again

Canada’s privacy watchdog says Staples Canada (again) failed to fully wipe personal data from some returned laptops before reselling them.

The finding comes from a recent investigation by the Office of the Privacy Commissioner of Canada, which found that some devices still contained customers’ personal information when they were sold to new buyers.

The issue is not new. A similar audit of Staples in 2011 flagged problems with how customer data was erased from returned computers. At the time, the company said it would improve its data-wiping process. Well, 15 years later, the privacy commissioner says some of the same issues are still happening.

As part of the investigation, the privacy commissioner reminded businesses that resell used or returned electronics that they are responsible for fully removing personal data. That includes performing a proper factory reset using the manufacturer’s instructions, giving employees clear and consistent guidance on how to wipe devices, and making sure staff are properly trained to carry out those technical steps.

“This investigation is an important reminder to all companies that sell returned computers and other electronic devices that they must protect the personal information of their customers by fully wiping devices before reselling them,” said Philippe Dufresne, Privacy Commissioner of Canada, in a statement on Tuesday.

Staples, which operates more than 300 stores across Canada and runs an Openbox program that resells returned laptops, came under scrutiny after a former employee filed a complaint with the privacy commissioner.

The former tech sales associate said he saw laptops being stored and resold without being properly wiped, including devices that still showed previous customers’ usernames, passwords, and even payment information.

He also alleged staff were not properly trained on how to erase data and that concerns raised internally were not addressed, leading him to file a formal complaint. The findings echo similar issues flagged by the privacy commissioner in 2011, when an earlier audit found Staples’ data-wiping procedures to be ineffective, despite the company committing at the time to improve how it removes personal information from returned devices.

While customers should always erase data from a laptop before returning, the Staples return policy states that “Staples ensures that any data on tech items is erased upon return,” which clearly did not happen in both of these cases it seems.

Staples Canada is owned by U.S. private equity firm Sycamore Partners, but the exact percentage of ownership is not publicly disclosed. Sycamore led the buyout of Staples’ parent company in 2017 as a private equity deal worth about $6.9 billion US.

Staples has confirmed it is updating its internal policies and will implement the privacy commissioner’s recommendations.

Update January 13, 2026: Staples Canada reached out and a spokesperson told iPhone in Canada the company “takes seriously the importance of protecting its customers’ personal information, and has policies and processes in place to do so. We accept the Privacy Commissioner of Canada’s recommendations as to process improvements. We will enhance our training and procedures as part of our continuous improvement and appreciate the feedback from the Privacy Commissioner. Our customers can shop with confidence, knowing that their personal information is taken seriously, and managed securely and compliantly.”