Do small businesses really need to worry about secure IT disposal?
Yes. The scale of your organisation does not reduce your legal obligations, and it does not reduce the real-world risk of a data breach from an improperly disposed device.
Consider what a typical small business laptop holds: client contact details, email correspondence, financial records, HR files, browser-saved passwords and business banking credentials. None of that data should survive the device’s retirement, and a file deletion or factory reset does not guarantee that it will not.
Under UK GDPR and the Data Protection Act 2018, you are required to handle personal data securely throughout its lifecycle — including at disposal. If a former employee’s details surface on a device you donated to a school without wiping, you remain accountable to the ICO, regardless of whether you are a sole trader or a multinational.
The WEEE Regulations 2013 add an environmental obligation: business IT equipment cannot go in general waste bins. It must be collected by a licensed carrier and processed at an authorised treatment facility (AATF).
For more detail on what ITAD covers and why it matters, see our guide on what ITAD is and how it works.
What counts as a “device” for secure IT disposal purposes?
Any device that has held business or personal data must be handled securely at disposal. That includes:
- Laptops and desktop computers
- Smartphones and tablets (company-issued or BYOD devices that held company data)
- External hard drives and USB sticks
- Printers with internal storage modules (many modern printers store copies of printed and scanned documents)
- Network-attached storage (NAS) devices
- Old routers and Wi-Fi access points (these hold network credentials)
- Servers, even small ones running in a back office
Small businesses often forget printers and routers. Both can hold recoverable data that compromises your organisation if they are not properly handled.
What is the difference between deleting files and secure IT disposal?
This is the most important distinction for small business owners to understand.
| Action | What actually happens to data |
|---|---|
| Delete a file | File pointer removed; data remains on drive until overwritten |
| Empty the recycle bin | Same as above |
| Factory reset (laptop) | May remove the operating system but not securely overwrite all data sectors |
| Factory reset (phone) | Varies by device; often insufficient for forensic recovery prevention |
| Certified software wipe (NIST 800-88 / HMG IS5) | All data sectors overwritten; unrecoverable by forensic tools |
| Physical shredding | Drive physically destroyed; no recovery possible |
Freely available data recovery tools can retrieve files from a “deleted” or “reset” drive. Only a certified overwrite or physical destruction prevents this.
How should a small business approach secure IT disposal?
Option 1: Use a certified ITAD provider
The most straightforward approach is to engage a certified provider who handles data destruction, issues certificates and manages WEEE-compliant recycling on your behalf.
Look for a provider who:
- Holds a valid Environment Agency waste carrier licence (verifiable at gov.uk)
- Is registered with the ICO as a data processor
- Holds ADISA certification or equivalent
- Issues a data destruction certificate per device and a waste transfer note
Recycle4Charity provides this service in London. For small volumes, we offer flexible arrangements — including collections from small offices and occasional single-device services. Visit our business services page to discuss your needs.
Option 2: Drop off at an approved facility
Some ITAD providers accept drop-offs at their processing facility for small volumes. This can be a cost-effective option for businesses disposing of a small number of devices. Confirm in advance that they will still issue data destruction certificates for dropped-off items.
Option 3: In-house wiping with certified tools (advanced users only)
If you have the technical capability to run DBAN, Blancco or an equivalent certified overwrite tool, and can retain the generated certificate per drive, in-house wiping is legally defensible. Most small businesses do not have the IT resource to implement this reliably, and without certificates, you have no audit trail.
What documentation do you need?
Even as a small business, you should retain:
- A data destruction certificate for every device disposed of (specifying make, model, serial number and destruction method)
- A waste transfer note confirming WEEE-compliant collection and recycling
These documents are your defence if the ICO ever queries your disposal practices. Keep them alongside your other data protection records.
How to build secure IT disposal into your small business processes
You do not need a lengthy formal policy to cover this. A simple procedure document that answers these questions is a good starting point:
- Which provider do we use for IT disposal?
- Who in the business is responsible for arranging disposal?
- What happens when an employee leaves with a company device?
- How do we handle personal devices (BYOD) that held company data?
- Where do we file the certificates we receive?
For a fuller template, see our IT equipment disposal policy template.
Can my old devices go to a good cause?
Yes — provided data destruction is completed first. Recycle4Charity refurbishes functional devices and gives them free to digitally-excluded Londoners. We wipe every device to a certified standard before it goes to any recipient. You receive a certificate, and a person who lacked access to technology gets a working device.
If your small business is replacing a handful of laptops, this is often the most satisfying outcome — your old equipment does genuine good rather than going straight to the smelter. Our IT asset recovery guide covers how this works.