UK GDPR and Old Devices: A Data Wiping Process for Small Businesses

Every small business eventually replaces its laptops, phones and desktops, and every one of those devices leaves with someone's personal data on it unless you remove it. Under UK data protection law, what happens to that data is your responsibility, even after the device has gone.

If you are choosing a tool, our article on selecting GDPR-ready erasure software covers the buying decision. This guide covers the step before that: what the law expects and a process a small firm can run without a dedicated IT team.

What does UK GDPR require when disposing of devices?

Personal data must be kept secure at every stage, including disposal, and kept no longer than necessary. The law does not name a wiping method; it expects measures appropriate to the risk and the ability to show what you did.

UK GDPR sits alongside the Data Protection Act 2018 and is enforced by the Information Commissioner's Office. Two principles do most of the work for old equipment:

• Integrity and confidentiality: appropriate technical and organisational measures must protect personal data against unauthorised access, including when equipment is retired.
• Storage limitation: personal data should not be kept longer than needed. A retired laptop full of client files is data you are still holding.

What happens if personal data is recovered from an old device?

It may be a personal data breach. Breaches likely to affect people's rights must be reported to the ICO within 72 hours, and serious ones may require telling the individuals affected.

Beyond any regulatory action, there is the conversation with a client whose details turned up on a second-hand laptop. Trust is hard to rebuild after that.

What are the common mistakes small businesses make?

Assuming a reset removes everything, using unmaintained free tools with no evidence, handing equipment to a recycler without a contract, and forgetting devices such as phones, USB sticks and copiers.

• Relying on a reset. A standard reset or quick format may leave recoverable data, and even the thorough options rarely leave a record.
• No evidence. Without a report or log, you cannot show that erasure succeeded.
• Passing the problem on. A recycler or reseller without a written contract and per-device records does not take over your responsibility.
• Forgotten devices. Old phones in drawers, external backup drives, USB sticks, the second disk in a desktop and multifunction printers with internal storage.

What is a simple disposal process for a small business?

Keep an asset list, retain only the data you need, erase each device with a method suited to its storage, keep a record, decide what to outsource, destroy what cannot be erased, and write it down in a short policy.

1. Keep an asset list. Type, serial number, user and location for every device that stores data. A spreadsheet is fine.
2. Retain what you must. Copy data needed for legal, tax or operational reasons to current systems; decide what should simply go.
3. Erase with a suitable method. Overwrite hard drives in full. Use the drive's own sanitise command for SSDs and NVMe drives, or cryptographic erase where the conditions are met. For phones and tablets, remove company accounts and device management first.
4. Keep a record. Device, serial number, method, date, result and who did it, with any tool report attached.
5. Decide what to outsource. In-house suits a handful of devices a year; a disposal provider can make sense for volume or failed drives, under a written processor contract with per-device records.
6. Destroy what cannot be erased. Failed drives, or drives you cannot verify as erased, should be physically destroyed by a reputable provider with a record.
7. Write a one-page policy. Who is responsible, which methods are used, what records are kept and for how long.

Guidance from the NCSC and NIST SP 800-88 describes these approaches and when destruction is the right answer. Our guide to asset disposal documentation covers record keeping in more depth.

Does an erasure report prove GDPR compliance?

No. A report records what was done to a device and is good evidence for your records, audits and insurers, but compliance depends on your whole process: policy, method choice, authorisation and record keeping.

We say the same about our own reports. They support your accountability; they do not replace it.

Which RedKey USB edition suits a small business?

RedKey USB Professional suits most small firms doing erasure in-house: it erases computers from USB, up to 16 disks per machine, and saves a PDF report per erasure. Ultimate adds selected Apple and Android phones and tablets.

The Home edition shows results on screen only, which is fine at home but leaves a business without written evidence. All editions are one-time purchases with unlimited use, so the cost does not grow with the number of devices you retire. For larger refreshes, the business packs let several people work at once.

Summary checklist

• Asset list of every data-bearing device.
• Required data retained on current systems.
• Erasure method matched to each drive type.
• A record or report for every device.
• Written contract with any disposal provider.
• Failed drives destroyed, with a record.
• One-page disposal policy in place.

Frequently asked questions

Does UK GDPR specify a data wiping standard?

No. It requires measures appropriate to the risk. Recognised guidance such as NIST SP 800-88 and NCSC advice helps you choose and justify a method.

Is a factory reset GDPR compliant?

A reset alone is hard to justify for business devices because it may leave data and rarely produces evidence. Use a full erase with a record.

Do we need to keep erasure records?

Keeping a record for each device is the practical way to show the ICO, auditors or clients that personal data was removed before disposal.

Ready to erase your own devices? See RedKey USB Professional. Related reading: Choosing GDPR Compliant Device Erasure Software and Asset Disposal Documentation That Stands Up.