When businesses think about IT equipment carrying data risk, printers and photocopiers rarely make the initial list, yet modern multifunction devices are, in effect, specialised computers with internal storage, and that storage often holds a genuinely significant volume of sensitive material by the time a device reaches end of life.

Most office multifunction printers built in the last decade or more include an internal hard drive or solid-state storage used to queue print jobs, store scanned documents temporarily, and in many cases retain a cache of recently processed documents for convenience features such as reprinting or fax storage. Depending on the model and configuration, this can include everything from routine internal correspondence to, in the wrong circumstances, sensitive HR, financial or customer documents that happened to pass through the device during its working life.

This risk has been documented publicly on several occasions, with investigations into second-hand office equipment finding recoverable scanned documents on devices that had been resold or disposed of without any data sanitisation step having taken place at all — largely because the organisations involved simply did not think of a photocopier as a device requiring the same disposal discipline as a laptop.

The practical complication is that sanitising this storage is not always as straightforward as with a standard laptop drive. Some manufacturers provide a built-in data overwrite or secure erase function accessible through the device’s own administrative menu, which should be run before a device is decommissioned. Others require the internal drive to be physically removed and sanitised or destroyed separately, in the same way any other storage media would be handled, particularly for older devices without a reliable built-in erase function.

For businesses managing a fleet of office printers and multifunction devices, often under a separate leasing or managed print services arrangement rather than direct IT ownership, this creates a coordination gap worth closing deliberately. Print equipment returned at the end of a lease term should go through the same data sanitisation verification as any owned IT asset, and this needs to be built explicitly into leasing return processes and managed print service contracts, rather than assumed to be handled automatically by the leasing company.

The wider lesson is a useful one to apply across an entire IT estate: any device with internal storage and a history of processing business documents — however unlikely it looks from the outside — warrants the same data sanitisation discipline as more obviously “computer-like” equipment.