Why server disposal carries the highest data risk
A single server may contain terabytes of data across multiple hard drives or SSDs. Unlike a laptop or phone, a server’s storage is typically partitioned across a RAID array, which means data may be spread across drives in non-obvious ways. Simply wiping individual drives within a RAID may not remove all data unless the array is first broken down and each drive wiped individually.
Server types that require particular care include:
– File servers — may hold years of staff files, HR records, financial documents
– Database servers — may contain customer records, transaction histories, health data
– Mail servers — may hold personal communications covered by UK GDPR
– Backup servers and NAS devices — may hold copies of data from across the organisation, sometimes including data long since deleted from primary systems
– Virtualisation hosts — may contain virtual machine images including guest operating systems and their data
Under UK GDPR and the Data Protection Act 2018, organisations must implement appropriate technical measures to protect personal data. The Information Commissioner’s Office (ICO) is clear that disposal of equipment containing personal data without confirmed destruction is a breach of these obligations. For context on your legal position, see our article on UK GDPR and old IT equipment.
Data destruction methods for servers
Certified software overwrite
The industry standard for functioning drives is software overwrite meeting NIST 800-88 (Guidelines for Media Sanitisation) or HMG Infosec Standard 5. For servers with multiple drives, each drive must be individually overwritten. The output is a certificate naming each drive by serial number and confirming the erasure standard and date.
Degaussing
A degausser applies a powerful magnetic field that destroys the magnetic domains storing data on HDDs and magnetic tapes. It is fast and reliable for hard disk drives but has no effect on SSDs (which use flash memory, not magnetic storage). Degaussed drives are permanently destroyed and cannot be reused.
Physical shredding
The most definitive method. Drives are fed through an industrial shredder and reduced to fragments below a specified particle size (typically 15mm or less for HDDs, smaller for SSDs). Certificates are issued listing each drive by serial number and confirming the shred particle size. This is the preferred method for end-of-life drives or drives that cannot be wiped by software.
On-site destruction
Where data sensitivity requires it, a certified provider can bring destruction equipment to your premises and destroy drives under your supervision. The certificate is issued on the spot. This eliminates the risk of data exposure during transit.
Chain of custody: why it matters
Chain of custody documentation traces each device from the moment it leaves your custody to confirmed destruction. For server disposal, this typically includes:
- Asset inventory — make, model, serial number, drive serial numbers, asset tag
- Collection manifest — signed by both your representative and the collection driver
- Waste Transfer Note — legally required for any transfer of controlled waste
- Data destruction certificate — for each drive, listing serial number, method, and standard applied
- Certificate of recycling or reuse — confirming the server chassis has entered a compliant WEEE stream
Keep all documentation for a minimum of two years. In the event of a regulatory enquiry or ICO investigation, this paperwork demonstrates due diligence.
Are servers classified as WEEE?
Yes. Servers, rack-mounted equipment, blade systems, storage arrays, and network infrastructure (switches, routers, firewalls) are all WEEE under the WEEE Regulations 2013. Businesses must not place this equipment in commercial waste. A Waste Transfer Note is required for every collection.
Preparing your server for disposal: a checklist
- Document all devices: make, model, serial number, drive configuration
- Back up any data still needed to a separate, secure system
- Notify relevant teams: IT, legal, compliance, finance (for asset deregistration)
- Decommission the server in your CMDB (Configuration Management Database) or asset register
- Remove the server from rack infrastructure
- Arrange certified data destruction (on-site or at a licensed facility)
- Obtain data destruction certificate for each drive
- Arrange WEEE collection with a certified ITAD provider
- Obtain Waste Transfer Note and certificate of recycling
- File all documentation
Can a decommissioned server be reused?
Where a server is relatively recent and in working order, reuse is preferable to recycling under the waste hierarchy. However, security requirements mean that business-grade server equipment is rarely suitable for direct donation — drives must first be destroyed. Refurbishers may install new drives and repurpose the chassis.
Recycle4Charity handles server disposals for London businesses, with certified data destruction for each drive and full WEEE compliance documentation. Visit our server recycling service page for more information.
What happens to a recycled server?
Server chassis are predominantly steel and aluminium, both of which have high recycling value. Circuit boards — including CPUs, memory modules, and network cards — are sent to specialist e-waste processors for precious metal recovery. Drives that have been shredded are processed for raw material recovery. Cables and power supplies are processed through separate WEEE streams.
Ready to dispose of your servers?
Recycle4Charity provides secure server disposal for London businesses, including certified data destruction, full chain of custody documentation, and WEEE-compliant processing. Contact us via our server recycling page to discuss your requirements.