Sooner or later, every business ends up with a stack of old computers, laptops, phones or tablets that no longer earn their keep. A hardware refresh, an office move or simply a run of aging kit means somebody has to decide what happens next. It is a decision worth taking seriously, because getting it wrong can leave a business exposed under UK GDPR.
Deleting Files Does Not Destroy Them
It is a common assumption that deleting files, or running a factory reset on a device, gets rid of the data stored on it. In practice, it does not. Both actions simply remove the pointer that tells the operating system where the data sits. The data itself stays on the drive until it is overwritten, which on a device with plenty of free space can take a long time. Free recovery software, easily found online, can pull deleted files back from a formatted device in minutes.
For any business that has stored personal data on that hardware, whether that is staff records, client files or financial information, this is a genuine risk rather than a technical footnote.
What UK GDPR Expects
The UK GDPR requires businesses to protect personal data throughout its lifecycle, and that includes the point at which a device is retired. The Information Commissioner’s Office has been clear that a standard format or factory reset does not meet this standard. What is expected is destruction that is permanent, supported by evidence that it happened.
That evidence takes the form of a certificate of data destruction. It is the document your data protection lead would file, and the one you would need to produce if a client, auditor or the ICO ever asked how your business handles retired IT equipment.
What a Proper Certificate Should Show
Not every certificate on the market is worth much. A certificate that would stand up to scrutiny should list, for each device processed, the make, model and serial number, the method used to destroy the data, and the date it was processed.
EcoTech IT issues an itemised certificate of data destruction for the devices we collect, with every device accounted for individually rather than a single vague statement covering an entire collection.
How the Data Is Destroyed
For any device that can still be switched on, EcoTech IT uses NIST 800-88 compliant data wiping, the recognised international standard for secure media sanitisation. It overwrites every addressable part of the drive to a level that makes recovery impossible using any known method.
Where a device is too damaged to wipe, we carry out certified physical destruction instead. Either way, the outcome is the same. The data is permanently gone and it is documented.
This Applies to Every Type of Business
It is easy to think this only matters for large companies with dedicated IT departments, but the obligation applies just as much to a small accountancy practice, a retail shop, a warehouse, a hospitality business or a professional office. Any organisation holding staff or customer data on retired hardware carries the same responsibility, whatever its size or sector.
A Simple Way to Qualify for Free Collection
If your business has around twenty or more working laptops, Windows 11-compatible desktops, or still-supported tablets, you may qualify for free collection. It is always worth getting in touch with a quick list or a few photos of what you have, since other items can sometimes qualify too. Businesses located close to one another can also combine collections to reach that threshold together, each receiving their own separate paperwork. Learn more about The Real Cost of Getting IT Disposal Wrong: A GDPR Guide for UK Businesses
Getting Started
If your business is holding onto old IT equipment and unsure what the correct next step is, the simplest thing to do is have a conversation. EcoTech IT provides certified data destruction and GDPR compliant disposal for businesses and schools across Wiltshire and the wider South West, with every device wiped or destroyed to the required standard and listed individually on the certificate you receive.
Contact EcoTech IT: hello@ecotechit.co.uk | +44 1380 714800 | ecotechit.co.uk
