Why you cannot simply throw away old office computers
Old office computers are not general waste. They are classed as WEEE — Waste Electrical and Electronic Equipment — under the WEEE Regulations 2013, which prohibit businesses from disposing of them in general waste streams. Beyond the environmental rules, they almost certainly contain personal data: employee records, client files, email histories, browser credentials and cached documents.
Under UK GDPR and the Data Protection Act 2018, your organisation is responsible for that data until it is demonstrably, irreversibly destroyed. A computer sitting in a skip or passed to an unlicensed collector still holds your data. If it ends up on eBay with readable files, the ICO may investigate your organisation.
This guide explains how to dispose of old office computers lawfully, whether you have one machine or a hundred.
Step 1: Stop using the devices and secure them
Before disposal begins, take the machines out of active use and store them in a locked room or secure area. Restrict access. Do not allow staff to remove machines without authorisation, and do not allow anyone to take a machine home without certified data destruction first.
Step 2: Do not wipe them yourself (unless you have the right tools)
Many organisations attempt to “wipe” computers by deleting files, emptying the recycle bin or running a factory reset. None of these approaches overwrites data to a forensic standard. Deleted files remain recoverable using freely available software.
If you have the technical capability to run a certified overwriting tool — one that complies with NIST 800-88 or the UK government’s HMG Infosec Standard 5 — and can generate and retain individual certificates for each drive, then in-house wiping may be acceptable. Most organisations do not have this capability or cannot produce the certificates the ICO would expect to see.
The safer approach is to pass the machines to a certified ITAD provider who performs data destruction as part of their service and issues a certificate per device as standard.
Step 3: Choose a certified recycling or disposal provider
When selecting a provider for computer disposal, verify:
- They hold a valid Environment Agency waste carrier licence — check the public register at gov.uk
- They are registered with the ICO as a data processor
- They hold ADISA certification or equivalent independently audited data destruction accreditation
- They will issue you with a data destruction certificate per device and a waste transfer note confirming WEEE-compliant recycling
Recycle4Charity provides certified computer recycling across London. Every device we process receives a data destruction certificate, and functional computers are refurbished and given free to digitally-excluded Londoners before anything goes to the recycler. You can find out more on our computer recycling page.
For a broader overview of business IT disposal options, visit our business services page.
Step 4: Arrange collection and sign the manifest
A reputable provider will collect from your premises. At collection, you should:
- Confirm that every machine on your list is captured on the provider’s collection manifest
- Sign the manifest and keep a copy
- Note the name of the waste carrier and their licence number
The signed manifest is the beginning of your audit trail. It is also a component of the duty-of-care documentation required under the Environmental Protection Act 1990.
Step 5: Receive your certificates
After processing, your provider should issue:
- A data destruction certificate for every computer, specifying the make, model, serial number, destruction method and standard used
- A waste transfer note confirming that WEEE was collected by a licensed carrier and processed at an authorised treatment facility
- An asset report listing every device and its final outcome (refurbished and donated, resold or recycled)
File these documents. If the ICO ever investigates a data breach linked to a retired device, these certificates are your evidence that you discharged your obligations.
What about computers that still work?
Functional computers should not go straight to recycling. Before the recycler gets involved, ask your ITAD provider about asset recovery: computers in good condition have a secondary market value, and recent models may generate a financial credit that offsets your disposal costs.
Alternatively, if you would like working machines to go to a good cause, Recycle4Charity refurbishes them and provides them free to people in London who lack access to technology. Data is destroyed to the same certified standard regardless of whether the device is recycled or donated.
Our guide to IT asset recovery explains how value recovery works in practice.
Common mistakes to avoid
| Mistake | Why it matters |
|---|---|
| Deleting files or reformatting the drive | Does not overwrite data; files remain recoverable |
| Using a general waste contractor | Does not satisfy WEEE Regulations 2013; no data destruction certificate |
| Giving computers to staff without wiping | Data breach under UK GDPR if personal data is recoverable |
| Storing old computers indefinitely | Data risk if premises are burgled or devices mislaid |
| Using a charity shop or skip | Neither route provides certified data destruction or WEEE compliance |
How many computers do you need to dispose of?
The process is the same whether you are disposing of one machine or a hundred, but the logistics differ. For a single machine, many ITAD providers offer a drop-off option. For a full office clear-out, a scheduled collection is more practical.
If your disposal project is part of a wider office move or closure, see our office IT decommissioning guide for a fuller walkthrough of the planning process.