It is a common but costly assumption that data protection obligations end once equipment is taken out of active use. Under UK GDPR, personal data stored on a laptop, server or mobile device remains subject to exactly the same protections at the point of disposal as it was while the device was in daily use, and the accountability principle means your organisation must be able to demonstrate that.

UK GDPR does not specify a particular technical method for destroying data, but it does require that personal data be processed securely, using appropriate technical and organisational measures, and that includes its eventual destruction. In practice, this means simply deleting files, performing a standard factory reset, or handing equipment to a general waste contractor without verified data sanitisation is very unlikely to meet the standard of “appropriate” that the regulation expects, particularly where the data involved includes special category data such as health records, or data relating to a large number of individuals.

The Information Commissioner’s Office has been explicit in guidance and in enforcement action that organisations remain responsible for personal data even after it leaves their direct control, if it is handed to a third party for disposal. This is why data processing agreements with ITAD providers matter — where a provider is sanitising or destroying data on your behalf, that relationship needs to be documented, with clear terms around how data will be handled, and it should sit alongside, not replace, your own due diligence on the provider’s competence.

Several ICO enforcement cases over the past decade involved organisations that had contracted disposal to a third party in good faith, but had not verified that the third party actually carried out the sanitisation it claimed to, or had not obtained meaningful evidence that it had. The regulatory consequence in these cases fell on the original data controller, not solely on the disposal contractor, reinforcing that outsourcing the physical process does not outsource the accountability.

The practical steps that reduce this exposure are consistent: use a provider that sanitises to a recognised standard such as NIST 800-88, obtain a certificate of erasure or destruction tied to specific serial numbers rather than a generic statement, retain those certificates as part of your data protection records, and periodically audit your provider rather than treating the relationship as a one-off procurement decision.

Data protection by design is a principle that is often discussed in the context of building new systems, but it applies equally at the other end of the equipment lifecycle. A clear, documented disposal process is one of the more straightforward compliance obligations to satisfy — provided it is not left as an afterthought.