Business laptop and IT equipment disposal: a practical checklist

Step 1: Build or update your asset list

Start with a list of everything you plan to retire. For each item record:

• device type and make
• serial number and any internal asset tag
• who last used it, or which team
• where it is now
• whether it holds, or may hold, personal or confidential data
• whether it is owned, leased or rented

Do not forget the things that are easy to miss: external drives, USB sticks, old phones and tablets, network storage, and printers or copiers with internal storage.

The ICO's disposal and deletion toolkit expects a log of equipment sent for disposal and a log of devices awaiting destruction and their location. Your asset list is the starting point for both.

Step 2: Check whether the devices are leased

This is the step most often skipped. Many businesses lease or rent laptops, phones and multifunction printers. If a device is leased, it is not yours to destroy.

• Check your finance and leasing agreements, or ask your finance team or IT provider.
• Find out what the agreement says about return condition and data on returned equipment.
• If storage drives must be destroyed but the device must be returned, ask the leasing company what it allows. Some agreements permit drive removal, others do not.
• Keep leased devices separate from owned ones, physically and on your list.

Destroying a leased device by mistake can create a contractual problem. Returning one with data still on it creates a data protection one.

Step 3: Decide between data wiping and physical destruction

There are two broad routes. The ICO lists secure methods such as device wiping, degaussing and hardware shredding.

Data wiping

Wiping uses software to overwrite or securely erase the storage so the data cannot be recovered, leaving the device usable.

• Suits devices that will be returned, reused or resold.
• Needs to be done with a suitable method for the storage type, and verified.
• You should get a record per device, showing serial number and result.

Physical destruction

Physical destruction means the storage is destroyed, for example by shredding hard drives and solid state drives.

• Suits drives that have failed, cannot be wiped reliably, or held highly sensitive data.
• Leaves nothing to recover, but the device or drive cannot be reused.

Which one?

Many businesses use both: wipe what can be returned or reused, destroy what cannot. Make the decision per device and write it on your asset list so the reason is recorded. If you are not sure, treat the device as needing destruction.

Step 4: Remove accounts and settings, then lock it away

Before collection:

• remove devices from device management, accounts and remote access tools
• record any device that will not power on, as it cannot be wiped and should be flagged for destruction
• remove SIM and memory cards and log them
• store everything in a locked room or cabinet with restricted access

The ICO expects devices awaiting destruction to be stored securely, for example in a locked area with restricted access, with a log of what is there. Keep the key holder list short.

Step 5: Watch out for batteries

Laptops, phones and tablets contain lithium batteries. They should never go in general waste or recycling bins. Keep them dry and undamaged until collection. We covered why in our post on office laptops and lithium batteries.

Step 6: Choose how you will hand over the equipment

Decide whether this is a one-off clear-out or part of a regular cycle. A single collection after an upgrade suits one-off shredding, which covers hard drives, PCs and servers as well as paper. Regular refreshes may suit a scheduled service through our IT and media recycling team.

Whoever you use, the ICO's guide to data security expects appropriate security measures, and that extends to the people handling your devices on your behalf. Agree in writing what will happen to each device.

Step 7: Get documentation back and close the loop

When devices leave, you need evidence of what happened to each one. For IT and media we provide chain of custody and destruction documentation, so you have an audit trail for your records.

• Match the documentation against your asset list, ideally by serial number.
• Mark each item as returned, wiped or destroyed, with the date and reference.
• Store the paperwork with your other disposal records. Our certificate of destruction guide explains what to look for.

Step 8: Know what to do if something goes missing

If a device that held personal data cannot be found, treat it as a possible personal data breach. The ICO explains when and how to report a breach. Where reporting is required, it must be within 72 hours of becoming aware of it.

The checklist at a glance

1. List every device with serial number, user and location.
2. Mark each as owned, leased or rented.
3. Check leasing terms before touching leased kit.
4. Decide wipe or destroy per device, and record why.
5. Remove from accounts and device management.
6. Store securely with restricted access and a log.
7. Keep batteries out of the bin.
8. Book collection and agree what will happen to each item.
9. Match documentation to your list and close each item off.
10. Escalate anything missing straight away.

Frequently asked questions