That laptop gathering dust in the stockroom looks harmless enough. Yet somewhere on its drive sit customer emails, invoices, passwords and payroll files. For small businesses, getting rid of old IT kit is one of the most overlooked data risks, and also one of the easiest to fix.
Why deleting files is not enough
When you empty the recycle bin, your files do not actually disappear. The computer simply marks that space as free to use. Until something new overwrites it, the original data stays put, and recovery tools that anyone can download often bring it back within minutes. Even a factory reset or a quick format leaves far more behind than most people expect.
What might still be on your devices
Think beyond laptops. Phones, tablets, external drives and even office printers with built-in storage can all hold information such as:
- Customer names, addresses and phone numbers
- Invoices, quotes and bank details
- Staff records and payslips
- Saved passwords and logged-in accounts
- Years of emails and attachments
What UK GDPR expects from a small business
Data protection is not just a headache for large corporations. UK GDPR applies to every organisation that handles personal data, whether you employ three people or three hundred. You are expected to keep that data secure throughout its entire lifecycle, and that includes the moment a device leaves your hands.
If an old laptop is sold, donated or recycled with readable personal data on it, that can count as a data breach. The Information Commissioner’s Office can issue fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. For most small firms, though, the bigger blow is the loss of trust when customers learn their details ended up with a stranger.
Accountability means being able to prove it
UK GDPR does not only ask you to do the right thing. It asks you to show that you did. If the regulator or a client ever asks what happened to a particular device, “we deleted everything” will not carry much weight. A record showing which device was wiped, when and how, will.
Wiping or destroying: which route makes sense?
There are two reliable ways to deal with old storage. Physical destruction, such as shredding a drive, is final but also means the hardware is gone for good. Certified erasure overwrites every part of the drive using recognised methods, checks the result and produces a certificate for each device.
For many small businesses, erasure is the smarter option. The device can be reused, resold or refurbished, which returns some value and keeps electronics out of landfill. Data erasure services from specialist IT asset disposal companies make this practical even if you only have a handful of devices to deal with.
What to look for in a provider
- Erasure based on a recognised standard such as NIST 800-88
- A certificate for every device, linked to its serial number
- Secure collection and a clear chain of custody
- Physical destruction as a backup for drives that cannot be wiped
- Reports you can simply file with your GDPR records
A simple routine for your business
You do not need an IT department to get this right. A few habits go a long way:
- Keep a basic list of every device that stores business data
- Store retired equipment somewhere locked rather than in a drawer
- Never hand old devices to staff, family or charity without a certified wipe
- Book erasure in batches, for example once or twice a year
- Save every certificate alongside your other data protection documents
Some specialists combine secure erasure with refurbishment, so your old hardware gets a second life while your data is safely gone. Circular IT group is one example of a company that works this way.
A small step with a big payoff
Old devices are easy to forget, but the data on them is not going anywhere by itself. By treating the end of a laptop’s life as seriously as its first day, you protect your customers, stay on the right side of UK GDPR and give your business one less thing to worry about.
