GDPR and Data Erasure: Disposing of IT Equipment Compliantly

GDPR and Data Erasure: Why It Matters

Under the UK GDPR and the Data Protection Act 2018, any organisation that holds personal data must protect it throughout its life, including when the equipment it sits on is retired. Hard drives, SSDs, laptops, servers and phones often contain names, addresses, health records, HR files and financial data long after they leave daily use.

Data erasure is how you close that gap. Verified wiping, or certified destruction where wiping is not possible, stops personal data from surviving on equipment you resell, recycle or hand back.

The UK GDPR Provisions That Apply

The Risk of Getting Disposal Wrong

An unwiped drive that is lost, stolen, sold or recycled can be a personal data breach. Consequences can include mandatory reporting to the ICO, notifying affected individuals, reputational damage and enforcement action. The UK GDPR sets maximum fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious infringements.

Most disposal incidents are not sophisticated attacks. They are process failures: an old server left in a storeroom, a batch of laptops sent to a recycler with no record, or drives assumed to be empty because files were deleted.

Controller and Processor Responsibilities

If you decide why and how personal data is processed, you are the data controller, and you stay responsible for that data even when someone else handles your equipment. A wiping provider generally acts as a data processor on your behalf.

• Put a written agreement in place that covers security, confidentiality and sub-processors
• Confirm how equipment is transported, stored and tracked
• Require a certificate and report that you can keep as evidence
• Check that destruction and recycling partners are also controlled and documented

Our free secure collection service is designed with chain of custody in mind, so your equipment is accounted for from pickup to final disposition.

Right to Erasure vs Wiping Devices

Article 17, often called the right to be forgotten, lets individuals ask you to delete their personal data in certain circumstances. That is a data-subject request handled inside your systems. Device wiping is a different, equipment-lifecycle task: it ensures personal data does not remain on hardware when you stop using it.

The two are connected. Data that has been legitimately erased from live systems can still linger on retired drives, backups and old servers if those are not wiped. A complete approach covers both, including backup media.

A Practical GDPR Checklist for IT Disposal

1. Keep an asset register that lists every device and drive with serial numbers
2. Classify the data held so you can choose the right erasure method
3. Wipe at decommissioning, not months later
4. Use verified erasure and keep the report for each device
5. Destroy any drive that cannot be wiped, and keep a destruction certificate
6. Use a contracted processor and record chain of custody
7. Retain certificates alongside your records of processing and review your policy regularly

See our data erasure certificate page for exactly what we record, and how it works for the end-to-end process.

Sector Notes: NHS, Councils and Schools

Public sector bodies often work to additional requirements on top of UK GDPR, such as NHS data security standards for health organisations. Whatever the framework, the underlying need is the same: secure, documented disposal of every device holding personal data.

The Paperwork That Proves Compliance

If the ICO, an auditor or a client asks how you disposed of old equipment, you should be able to produce:

• Your asset register entry for each device
• The erasure or destruction certificate and per-device report
• Chain-of-custody records from collection to final disposition
• The processor agreement with your wiping supplier
• Your written media sanitization or disposal policy

For the methodology behind the wipe itself, read our guide to NIST 800-88.