Public sector bodies hold some of the most sensitive information in the country: patient records, social care files, pupil data, benefits and housing information. When the computers and servers that held it are retired, that data must not go with them. This guide explains what public bodies should expect from secure data wiping and what to ask suppliers.
Why the stakes are higher in the public sector
Health information is special category data under UK GDPR, which means it needs extra protection. Councils, schools and government departments also hold data about vulnerable people. A single unwiped drive can expose thousands of records, trigger a breach report to the ICO and damage public trust. Large estates add to the risk, with many sites, many devices and constant refresh cycles.
The rules and guidance to be aware of
Public bodies work to UK GDPR and the Data Protection Act 2018. Health and care organisations also complete the Data Security and Protection Toolkit, which expects secure processes for disposing of IT equipment. The National Cyber Security Centre publishes guidance on the secure sanitisation of storage media, and many procurement frameworks refer to NIST 800-88 as a benchmark. Requirements vary by organisation, so always check your own policies and contracts. Our guides to GDPR and data erasure and NIST 800-88 explain the principles.
Migrate and retain before you wipe
Wiping is permanent. Before any device is erased, confirm that records you are required to keep have been migrated to a managed system and that backups are in place. Retention rules for health, social care and education records are strict, and erasing the only copy of a record you must retain is a problem of its own. Wipe the device once the data it held has been dealt with properly.
What public bodies should ask a wiping supplier
- Is each device recorded by serial number, with a certificate and report?
- Which methods are used for hard drives, SSDs and mobile devices?
- How is the result verified?
- How is equipment tracked, stored and transported?
- Can wiping be done on site if equipment cannot leave the premises?
- What happens to drives that cannot be wiped?
- Is there a written processor agreement covering data protection?
- Can the supplier handle volume, multiple sites and scheduled collections?
On-site or off-site?
Many trusts and councils prefer that data never leaves their premises until it has been erased. On-site data wiping meets that need: the team attends your site, erases the equipment where it sits and lets your staff witness the process. For routine volumes, secure collection with chain of custody is often simpler, and for hospital-wide or council-wide refreshes bulk data wiping keeps projects on schedule.
Chain of custody and audit evidence
Public bodies are accountable to regulators, auditors and the public, so evidence matters as much as erasure. Every device should be traceable from collection to final disposition, and every job should end with a data erasure certificate that lists serial numbers. Keep these records with your asset register for as long as your retention policy requires.
What about devices that cannot be wiped?
Faulty drives, damaged equipment and anything without a trusted erase method should be physically destroyed. Certified data destruction provides a record of destruction by serial number, so every device has a documented final status. Shredded material is recycled in line with WEEE rules.
A practical checklist for public sector IT teams
- Keep an up-to-date asset register of devices and drives.
- Confirm data is migrated and retention duties are met before decommissioning.
- Choose the erasure method by media type: overwrite for hard drives, firmware or cryptographic erase for SSDs.
- Wipe at decommissioning rather than months later.
- Use a contracted processor and record chain of custody.
- Keep certificates and destruction records with your asset register.
- Review your disposal policy regularly.
Sector pages
We provide secure wiping for NHS and healthcare trusts, councils and government and schools and universities, from a single device to thousands.
Frequently asked questions
Do NHS organisations have to wipe data from old devices? They must protect patient data throughout its life, including when equipment is retired. Verified wiping or destruction is the practical way to do this.
Can data be wiped on site at a hospital or council office? Yes. On-site wiping means equipment never leaves your premises.
What proof will we receive? A certificate and serial-level report for every job, and a record of destruction for any drives that are shredded.
Talk to us about your estate
We support public sector bodies across the UK with free collection, on-site options and audit-ready reporting. Request a free quote and we will reply within 24 hours.
