IT disposal and UK GDPR: how to destroy data on old equipment

Updated 6 November 2026 · By the IT Equipment Disposal team

Short answer: Under UK GDPR, organisations must keep personal data secure until it is destroyed, including on IT equipment being disposed of. Deleting files or formatting a drive is not enough: drives should be overwritten or securely erased with certified software and verified, or physically shredded, and each device should be recorded on a data destruction certificate. Recognised reference points include NIST SP 800-88, NCSC secure sanitisation guidance and ADISA certification.

Why it matters

If a disposed laptop, phone or server still holds personal data and ends up in the wrong hands, that can be a personal data breach. Serious breaches may need to be reported to the ICO, which can issue large fines. Your responsibility does not end when the equipment leaves your building, so choose a provider that gives you proof of destruction for every device.

Wiping versus shredding

	Certified wiping	Physical shredding
Device can be reused	Yes	No
Typical cost	Lower, often offset by resale	Higher per drive
Works on faulty drives	No	Yes
Suitable for SSDs	Yes, using secure erase and verification	Yes, to a small particle size
Evidence provided	Per-device erasure report	Certificate of destruction

What to ask a provider

Which erasure standard or software do you use
Will I get a report listing each device by serial number
Can drives be shredded on site if needed
How is equipment secured in transit
Are you a registered waste carrier and where is the WEEE treated
Do you hold any recognised data destruction certification such as ADISA

Do not forget these devices

Phones and tablets
Multifunction printers and copiers, which often have internal drives
Network storage, USB drives and backup tapes
Smart TVs and meeting room systems logged into business accounts