Most businesses do not set out to breach GDPR. It tends to happen quietly, through decisions that seemed reasonable at the time. Old laptops donated to a local group without being wiped properly. A box of hard drives sent to a general recycler with no paperwork to show what happened to them. None of these decisions feel careless in the moment, but they can carry real consequences.
Why Old Hardware Is Still a Live Risk
A laptop that has not been switched on in a year can still hold exactly the same personal data it did on the day it was retired. Staff records, client files, invoices, HR documents- none of that disappears simply because the device has been sitting in a cupboard. The data is either destroyed properly or it is not, and time does not change that.
Under UK GDPR, any business holding personal data is required to protect it through its entire lifecycle, including the point at which the device holding it is retired. Assuming a format or factory reset has dealt with it is not a defensible position if a client, auditor or the ICO ever asks.
What Compliant Disposal Actually Involves
Getting this right does not need to be complicated. It comes down to two things. First, certified destruction, using NIST 800-88 compliant data wiping for any device that can be switched on, or physical destruction where it cannot. This is the recognised standard, not a format or a reset. Second, documentation, with every device processed appearing individually on a certificate of data destruction that records the make, model, serial number, method and date.
It Is Not Just a Large Company Problem
Retail businesses, hospitality venues, professional practices, manufacturers, warehouses and general offices across the UK all hold personal data on retired hardware, whether that is customer records, staff files or supplier information. The size of a business does not reduce the obligation. A five person office and a fifty person office carry exactly the same responsibility under UK GDPR.
A Note on Locked Devices
If any devices being disposed of are still locked to an account or under mobile device management, such as some Chromebooks, tablets or phones, these should be unlocked before collection wherever possible. Locked devices carry little to no resale value and typically attract a small charge, so releasing them from account or MDM management ahead of time is worth doing if you can.
What Cannot Be Included
One item worth knowing about in advance is magnetic tape. It is not accepted for disposal under any circumstances, so if your business is clearing out older backup systems, this is worth checking before a collection is booked.
How EcoTech IT Handles It
EcoTech IT provides certified data destruction and GDPR compliant disposal for businesses and schools across Wiltshire, Somerset, Dorset and Hampshire. Every device is either NIST 800-88 wiped or physically destroyed, and every device is listed individually on the certificate of data destruction you receive once the work is complete.
Businesses with around twenty or more working laptops, Windows 11-compatible desktops or still-supported tablets may qualify for free collection, and it is always worth getting in touch with a list or some photos, since other devices can sometimes qualify too. Nearby businesses can also combine their collections to reach that threshold together, each receiving their own separate paperwork and processing. Learn more about NIST 800-88 Compliant Data Wiping Explained: What UK Businesses Need to Know
Getting Started
If your business has old IT equipment sitting around and you are not sure what your obligations are, the simplest step is to get in touch. We will talk you through what is involved, give you a straightforward answer on what you might qualify for, and arrange a collection time that works for you.
Contact EcoTech IT: hello@ecotechit.co.uk | +44 1380 714800 | ecotechit.co.uk
