Old computers are electrical waste, and the hard drives may hold personal data, so both sets of rules apply. Your business stays responsible for that data under UK GDPR. Have drives securely erased or physically destroyed before or during collection, keep written proof, and make sure the equipment goes to a registered carrier with a waste transfer note.
Key points
- Your business remains responsible for personal data on its devices until it is properly erased or destroyed.
- UK GDPR does not prescribe one method, so choose one that matches the risk and record what you did.
- Use a provider with recognised certification and a written contract if someone else handles the drives.
- Computers are electrical waste: use a registered carrier and keep a waste transfer note.
Who is responsible for the data on old computers?
You are. Under UK GDPR, personal data must be protected by appropriate technical and organisational measures, and the Information Commissioner's Office (ICO) says this covers how you dispose of paper and electronic waste. A laptop that leaves the building with customer or staff records on it is a security incident, even if it is headed for the scrap heap.
A clearance company that collects your computers is not automatically responsible for the data on them. If a third party handles or erases the drives for you, the ICO treats it as a processor, and your contract should require it to meet the same security standard you would. The ICO also says you should choose a processor that gives sufficient guarantees and that your contract should let you ask for evidence of compliance, such as audits.
Is wiping a hard drive enough under UK GDPR?
UK GDPR does not name a specific wiping method. The ICO says the right measures depend on the risk to individuals, the nature of the data and the cost and state of the art. In practice, that means the more sensitive the data, the stronger the method you should choose, and the more carefully you should record it.
The National Cyber Security Centre (NCSC) publishes practical guidance on this. It sets out the main options, summarised below.
| Method | What it involves | Notes |
|---|---|---|
| Factory reset of an encrypted device | Resetting deletes the encryption keys, which makes the data unreadable | NCSC says this cannot guarantee that all data is gone, but gives a satisfactory level of assurance for most devices |
| Overwriting an unencrypted device | Overwrite all user accessible memory with a fixed value, check for remapped or bad sectors, power off fully for at least 15 minutes, then read back to confirm | Use the manufacturer's tools such as ATA or NVMe Sanitize commands where available |
| Physical destruction | Erase first, then shred or grind the media to particles of 6mm or less and verify the particle size | Suitable for drives that are faulty or hold highly sensitive data |
| Degaussing | Uses a strong magnetic field | Only suitable for purely magnetic media, and you must confirm it works on your drive type |
A simple delete command or emptying the recycle bin is not enough, because the data usually remains on the drive. If you are unsure, physical destruction after erasure is the safest route.
Do I need a data destruction certificate?
We found no rule in UK GDPR or in the guidance we reviewed that requires one particular certificate. However, UK GDPR expects you to be able to show that your security measures were appropriate, and a certificate is strong evidence. The ICO says security measures should be documented and reviewed.
A useful certificate should list the serial numbers or asset tags of each device, the method used, the date, the person or company responsible and the standard followed. Without serial numbers, it proves very little.
Options for handling the drives during a clearance
You have three practical choices, and the right one depends on how sensitive your data is and how much equipment you have.
- Erase in house: your IT team or IT provider wipes the devices before the clearance date and logs each one. This costs the least and gives you full control.
- Remove the drives: take out the hard drives and keep them for separate destruction, then let the clearance firm remove the empty shells.
- Use a specialist data destruction provider: they erase or shred devices, either on site or at their premises, and issue a certificate. This is the usual choice for larger offices or regulated sectors.
Whichever route you choose, agree it in writing before the clearance starts. A general clearance team that quotes only for removal and disposal should not be assumed to be erasing data. Our guide to office clearance costs explains what to ask for when you compare quotes.
Paper records need the same care. Confidential files, post and printed reports should be shredded or collected by a secure shredding service rather than put into general waste or a skip.
The waste rules for computers and electrical equipment
Old computers, monitors and printers count as waste electrical and electronic equipment (WEEE). When a business disposes of it, the normal duty of care applies. NetRegs, the environmental guidance service for UK businesses, says you should store the equipment safely, use a registered waste carrier and keep a waste transfer note when it leaves your site.
There are some useful rules about who pays. For equipment bought after 13 August 2005 and marked with the crossed out wheeled bin symbol, the producer usually pays for treatment and recycling unless you agree something different. For leased or rented equipment, the provider is normally responsible for disposal. Check your purchase and lease paperwork before you pay a clearance firm to take it.
Our guides explain how to check a waste carrier licence and what a waste transfer note contains. If the equipment is in an office in Edinburgh or Leeds, the carrier check is the same in principle, but you use SEPA's register in Scotland and the Environment Agency's register in England. In Wales, the regulator is Natural Resources Wales.
For a general overview of what clearance companies do, see our office clearance hub.
Quick answers
How do you dispose of old office computers safely?
First erase or destroy the data using a method suited to the risk, and record it. Then pass the equipment to a registered waste carrier or a reputable IT disposal provider, and keep the waste transfer note. Check whether the producer or lessor must take the equipment back.
Do I need a data destruction certificate?
No single certificate is required by law as far as we could find. But UK GDPR expects you to show your security was appropriate, and a certificate listing each device, the method and the date is the best evidence. Ask for one if a third party handles your drives.
Is wiping a hard drive enough under UK GDPR?
It can be, if the method is suitable for the risk and you can show it worked. The NCSC sets out overwriting, encryption key deletion and physical destruction. Simply deleting files is not enough. For highly sensitive data, destroy the drive physically after erasing it.
Who is responsible if data leaks after my computers leave the office?
Your business remains the data controller and must keep personal data secure. If a processor handles the drives, you need a contract requiring proper security, and you should be able to ask for evidence. Responsibility does not simply pass to the clearance company.
Find a trusted office clearance firm
We rank the five best office clearance companies in 11 UK cities on reviews, licensing and recycling. Nobody pays to be listed. See all office clearance rankings.
Sources
- ICO: A guide to data security (UK GDPR)
- NCSC: Secure sanitisation and disposal of storage media
- NetRegs: Users of electrical and electronic equipment, what you must do
- GOV.UK: Waste duty of care code of practice (November 2018)
- GOV.UK: Dispose of business or commercial waste
Prices and council fees quoted from our city rankings were checked on 3 November 2026. Rules can change, so check with your council or the regulator before you act. This guide is general information, not legal advice.
