Why you cannot simply throw away a hard drive
A hard drive placed in general waste or an office bin poses two distinct risks. First, the data it contains may still be fully recoverable, exposing the personal or confidential information of customers, employees, or patients. Second, hard drives contain hazardous materials — lead, mercury, cadmium — that make them classified as waste electrical and electronic equipment (WEEE) under the WEEE Regulations 2013. Sending WEEE to landfill or general waste is illegal in the UK.
Both risks carry regulatory consequences. The Information Commissioner’s Office (ICO) can take enforcement action against organisations that allow personal data to escape their control on unwiped drives. The Environment Agency can take action against businesses that dispose of WEEE incorrectly.
Secure, compliant disposal requires two steps: data destruction first, then recycling through an authorised treatment facility.
Step 1: Destroy the data
Before a hard drive leaves your control, its data must be permanently destroyed. There are two reliable methods:
Software wiping: Certified overwriting software writes new data over every addressable sector of the drive, then verifies that overwriting was successful. This produces a per-drive verification report and allows the drive to be reused. The process should be carried out to a recognised standard — NIST Special Publication 800-88 or NCSC secure sanitisation guidance.
Physical shredding: The drive is mechanically shredded into fragments too small to reconstruct. This is the most certain method and is appropriate for drives with bad sectors, drives that cannot be reliably wiped, or situations where the data sensitivity demands the highest assurance. Shredded fragments are recycled as raw material.
Do not rely on deletion, formatting, or factory resets as substitutes for proper data destruction. These methods leave data recoverable.
For a detailed comparison of methods, see our guide to data wiping vs shredding vs degaussing.
Step 2: Recycle the hardware
Once data has been destroyed, the drive — whether intact after wiping, or in fragments after shredding — must be recycled through an authorised route under the WEEE Regulations 2013.
Options include:
- Certified IT asset disposal (ITAD) provider: An ITAD provider handles both data destruction and WEEE-compliant recycling in a single service. This is the most straightforward route for businesses disposing of multiple drives or a mixed IT estate.
- WEEE take-back scheme: Some manufacturers and retailers operate take-back schemes under which they accept old equipment for recycling. These schemes do not typically include certified data destruction, so drives should be wiped before handover.
- Local authority HWRC: Household waste recycling centres accept WEEE, but they are not designed for business volumes and do not offer data destruction services.
For business disposal, using a certified ITAD provider is the most efficient and compliant route because it addresses both data destruction and WEEE recycling in one step and provides the documentation needed to demonstrate compliance.
What documentation do you need?
UK GDPR’s accountability principle requires organisations to be able to demonstrate compliance. For hard drive disposal, that means keeping records of:
- Every drive disposed of (make, model, serial number)
- The destruction method used
- The standard to which it was applied
- The date of destruction
- The name of the provider or individual who carried out the work
A certificate of data destruction, issued by the ITAD provider for every collection, is the standard way to hold this evidence. Keep certificates for at least as long as your data retention policy requires — and ideally for the duration of any relevant regulatory limitation period.
For more on what a certificate should contain, see our guide to certificates of data destruction.
What about old drives from laptops and desktops?
When a business retires a laptop or desktop, the internal hard drive should be addressed as part of the retirement process. Options are:
- Wipe the drive in situ before the machine is collected for recycling, if you have the tools and expertise to do so correctly
- Use an ITAD provider that wipes or shreds drives as part of their collection service and provides certification
- Remove drives before donating or recycling machines, and arrange separate destruction
Do not donate or sell a machine without first confirming that the drive has been securely wiped. This applies equally to SSDs, which store data in flash memory and require specific wiping commands — standard overwrite tools designed for magnetic drives may not be effective.
Drives from defunct businesses
If a business is being wound up and IT equipment is being disposed of as part of the process, the obligation to destroy personal data does not lapse. The organisation remains responsible for data held on its systems until that data is formally destroyed or the business is dissolved. In practice, this means engaging a certified ITAD provider before equipment is handed over to administrators, landlords, or third parties.
How Recycle4Charity can help
Recycle4Charity is a London-based Community Interest Company providing certified IT asset disposal for businesses. We collect hard drives and full IT estates, carry out certified data wiping or shredding, issue a certificate of data destruction for every collection, and recycle all materials through WEEE-compliant routes.
Drives that pass data wiping and quality checks are refurbished and donated free of charge to digitally-excluded Londoners — so your disposal also has a social benefit.
Visit our hard drive and media destruction page to learn more, or contact us to arrange a collection.