Disposing of old office IT equipment incorrectly puts your business at risk. This guide covers the right approach, common mistakes, and the documentation you need.
Most businesses treat the disposal of old office IT assets as an afterthought. Equipment gets passed to a member of staff to sort out, stacked in a storeroom until someone makes a decision, or handed over to whoever offers to take it away. Each of these approaches carries risk that is not always obvious until something goes wrong.
This guide covers the right way to approach IT asset disposal, the most common mistakes that create legal and data security problems, and what documentation you should expect to receive. For the legal framework that underpins these requirements, our article on legal obligations when disposing of old IT assets provides a detailed overview of WEEE and GDPR obligations.
Old IT equipment is not simply unwanted hardware. It contains business data, customer records, and personal information that remains on a device until it has been properly destroyed. That data is your responsibility under UK GDPR for as long as the device exists, regardless of whether you are still using it.
WEEE disposal for businesses is a legal requirement, not an optional standard. The WEEE Regulations prohibit disposal of electrical and electronic equipment through general waste channels. A laptop in a skip is not just an environmental issue – it is a regulatory breach and leaves your business with no audit trail. Our page on secure data destruction explains what proper sanitisation involves and why factory resets fall short.
Getting IT asset disposal right is not as complicated or costly as many businesses assume. The right provider handles both obligations – WEEE compliance and data destruction – as part of our standard service, and for qualifying volumes that service is provided free of charge.
Understanding where things typically go wrong is a useful starting point. Below is a list of scenarios we encounter most often.
Donating or selling devices without wiping them is one of the most frequent errors. A factory reset or standard delete does not constitute secure data destruction. Data can be recovered from devices that have not been properly sanitised using widely available tools. The fact that the device was gifted rather than sold is not a defence under GDPR.
Using a general waste skip or an unlicensed collector breaches WEEE regulations and leaves no audit trail. If the ICO or Environment Agency later investigates, the absence of documentation is itself evidence of non-compliance, even if the disposal was otherwise handled responsibly.
Storing devices indefinitely is a common way of deferring a decision that feels complicated. It is not a solution. Devices sitting in a storeroom still represent an active data liability and an unmet WEEE obligation. The risk does not reduce over time; it compounds it.
Relying on a staff member to handle disposal informally, without involving a certified provider, means the business has no certificates, no audit trail, and no way to demonstrate compliance if it is ever challenged. Good intentions are not documentation.
Assuming a manufacturer take-back scheme covers your obligations is another frequent miscalculation. Take-back schemes vary considerably in the documentation they provide and the data destruction standards they apply. Before using one, it is worth confirming whether it meets the standard your business needs.
Correct IT asset disposal for UK businesses involves a small number of clear steps, consistently applied.
The first is using a certified WEEE recycler authorised by the relevant UK environmental agency. This is not optional – it is the legal baseline. An authorised recycler will maintain the chain of custody, process equipment through licensed facilities, and provide the documentation your business needs to demonstrate compliance.
The second is ensuring that all data-bearing devices are sanitised using NCSC-approved methods. Deletion and formatting are not sufficient. The standard required is one that renders data unrecoverable by forensic means.
The third is retaining documentation. That means a Certificate of Recycling confirming equipment has been processed through an authorised facility, and a Certificate of Data Destruction for each data-bearing device, providing an individual audit trail. These records should be kept for a minimum of three years and made available if requested during an audit or investigation.
You can view examples of our certificates on the website to understand what properly constituted documentation looks like.
Knowing how to dispose of office IT equipment correctly starts with understanding which devices are covered. The WEEE Regulations apply to a broad range of hardware. Our full list of what we collect covers the complete range, but for most office environments the relevant categories include:
If a device has ever held business or personal data, it should be treated as data-bearing and processed accordingly, regardless of its age or condition. Broken or legacy devices are accepted and do not need to be in working order to qualify for collection.
We provide free collection for businesses with at least ten laptops, PCs, or servers to recycle in any combination. Every device is assessed for refurbishment and reuse potential before any recycling or materials recovery decision is made. Reuse is always the preferred outcome. Where refurbishment is not viable, equipment proceeds to material recycling through our authorised downstream processors. Nothing we collect goes to landfill, and all material streams are accounted for. You can read more about how the process works on the website.
All data-bearing devices are processed using NCSC-approved sanitisation methods as standard. Certificates of Recycling and Data Destruction are provided for every collection. Our staff are background-checked, our vehicles are tracked, and chain of custody is maintained from collection through to destruction. All processing takes place in the UK.
If you have a backlog of old devices or are planning an IT refresh, contact us to arrange a compliant, free collection. We handle the process from collection through to certification, so your business is covered from the moment we collect.
No. We carry out all data sanitisation as part of the standard service using NCSC-approved methods. You do not need to take any action on devices before collection.
Broken and legacy devices are accepted. Equipment does not need to be in working order to qualify for collection and recycling. If a device has ever held data, it will be processed as a data-bearing item regardless of condition.
No. Devices in storage still represent an active data liability and a continuing WEEE obligation. Disposal should not be deferred indefinitely. If you have a backlog of equipment that has been sitting in storage, we can arrange collection and deal with it in a single visit.
You will receive a Certificate of Recycling for all items collected and a Certificate of Data Destruction for each data-bearing device processed. These are the documents you need to retain in order to demonstrate compliance during an audit or investigation. Examples of our certificates are available on the website.
Not necessarily. Our free collection service covers businesses with at least ten qualifying items. The certificates, data destruction, and WEEE-compliant processing are all included. The cost of getting it wrong – through ICO investigations, Environment Agency enforcement, or audit findings could be considerable.