Every business has a legal responsibility for personal data, even after the hardware holding it has left the building. This guide covers what counts as data-bearing equipment, what the Information Commissioner's Office expects for secure disposal, and what to check before it is collected. This is general information, not legal advice.
The short version
- Data-bearing equipment is not just computers — think printers, phones, servers, even some photocopiers.
- Wiping, degaussing or physical destruction are the ICO's recommended methods.
- You remain responsible for a data breach even after equipment has left your premises.
- Get a Certificate of Data Destruction, and keep it with your other records.
What counts as data-bearing equipment
It is easy to think only of desktop computers and laptops, but the category is broader:
- Desktop computers, laptops and tablets
- Servers and network storage
- Photocopiers and printers with internal memory or hard drives
- Mobile phones and SIM cards
- USB drives, external hard drives and backup tapes
- Some older telephone systems with call logs stored locally
What the ICO expects
The Information Commissioner’s Office, which regulates data protection in the UK, expects organisations to use documented secure disposal methods: wiping, degaussing, or physical destruction such as shredding. Devices awaiting destruction should be stored securely, ideally in a locked area with restricted access, with a log of what is awaiting destruction and who has accessed it in the meantime.
Your responsibility does not end at the door
This is the point most businesses underestimate: if personal data is later recovered from equipment you disposed of, even after it has left your premises and passed through one or more other parties, your business can still be held responsible for the breach under UK GDPR. This is why using a provider with a proper contract and a genuine, documented destruction process matters, rather than simply trusting that “it will be wiped somewhere down the line.”
A checklist before collection
Before data-bearing equipment leaves your premises:
What to ask your clearance company
Not every clearance company handles data destruction directly — some will refer you to a specialist partner, which is a reasonable approach as long as the handover between them is clear. Worth asking directly:
- Is data-bearing equipment separated from general clearance items?
- Who actually performs the destruction, and to what standard?
- Will you receive a Certificate of Data Destruction, and how quickly?
- What happens to equipment between collection and destruction?
Frequently asked questions
Is deleting files enough before disposal?
No. Standard deletion does not remove data securely from a storage device; it can often be recovered. Wiping to a recognised standard, degaussing, or physical destruction is what the ICO expects.
What if we don't know exactly what's on old equipment?
Treat it as though it holds personal or confidential data unless you can confirm otherwise, and apply the same secure destruction process rather than assuming it is safe to skip.
How long should we keep the destruction certificate?
Alongside your other waste transfer records, keeping data destruction certificates for at least a similar period is sensible practice, so you can evidence compliance if it is ever questioned.
Does this apply to printers and photocopiers too?
Yes, particularly modern multifunction devices, which often store scanned or printed document data internally and are easy to overlook compared with computers.
Key takeaways
- Data-bearing equipment includes printers, phones and servers, not just computers.
- The ICO expects wiping, degaussing or physical destruction, documented.
- Your business remains responsible for a breach even after equipment leaves your premises.
- Get a Certificate of Data Destruction and keep it with your records.
See office clearance and strip-out or warehouse and industrial clearance, or request a quote and flag any data-bearing equipment.