Most organisations know, in general terms, that old IT equipment needs to be “dealt with properly” before it leaves the building. Far fewer can say exactly what that means, or what they’d produce if someone asked them to prove it. That gap between assuming the job was done and being able to show it was done is where a certificate of data destruction comes in.
Deleting Is Not Destroying
It’s a persistent misunderstanding: that deleting files, or running a factory reset, removes the data from a device. It doesn’t. Both actions simply remove the pointer that tells the operating system where the data is stored. The data itself stays on the drive, fully intact, until it’s overwritten and on a drive with plenty of free space, that can take a long time. Freely available recovery software can pull deleted files back from a “wiped” laptop in minutes.
For any organisation that has held personal data on that hardware a school, an engineering firm, an architectural practice, a general office this is a genuine compliance risk, not just a technical curiosity.
What UK GDPR Actually Requires
The UK GDPR requires organisations to put “appropriate technical and organisational measures” in place to protect personal data, and that obligation doesn’t stop when a device is retired. The Information Commissioner’s Office (ICO) has been clear that a standard format or reset does not meet this bar. What’s expected is destruction that is permanent, and documentation that proves it happened.
That’s precisely what a certificate of data destruction is for. It’s not a marketing flourish, it’s the evidence your data protection officer files, and the document you’d produce if the ICO, an auditor, or a client carrying out due diligence ever asked to see it.
What a Proper Certificate Should Include
Not every certificate is worth the paper it’s printed on. A certificate that actually stands up to scrutiny should show, for each device:
– Make, model, and serial number
– The method of destruction used (data wiping or physical destruction)
– The date the device was processed
– Confirmation from the provider carrying out the work
EcoTech IT issues an itemised, serialised certificate of data destruction for the devices we process every device accounted for individually, not lumped into a single vague statement that “your hardware has been dealt with.” That’s the level of detail an ICO audit, a governing body, or a client’s due diligence request actually wants to see.
How the Data Is Actually Destroyed
For any functional storage device, EcoTech IT uses NIST 800-88 compliant data wiping the internationally recognised standard for secure media sanitisation. It’s a very different process to a standard format: it overwrites every addressable sector of the drive, not just the parts the operating system shows you, to a standard that makes recovery impossible using any known technique.
Where a device can’t be powered on, or is too damaged to wipe, we carry out certified physical destruction instead. Either way, the outcome is the same: the data is permanently gone, and it’s documented.
Who This Matters Most For
Schools hold some of the most sensitive personal data in the UK GDPR framework pupil records, safeguarding files, staff HR information which makes certified destruction and proper documentation non-negotiable rather than a nice-to-have.
The same obligation applies just as firmly to corporate clients. Engineering firms, architectural practices, and general offices all hold staff records, client files, and commercially sensitive information on retired laptops, desktops, and servers. A director assuming “IT sorted it” isn’t a defensible position if the ICO comes asking. Learn more about GDPR and Old IT Equipment: What Schools and Offices in Wiltshire Need to Know
The Straightforward Answer
If your organisation is disposing of old IT hardware and you’re not currently receiving a certificate of data destruction for every device, that’s worth addressing before your next hardware refresh not after something goes wrong.
EcoTech IT provides certified data destruction and GDPR compliant data disposal for schools and businesses across Wiltshire and the wider South West. Every device is wiped or physically destroyed to the required standard, and every device is listed individually on the certificate you receive at the end.
