Is deleting files enough before disposing of a laptop?

No. Deleted files and reformatted drives can usually be recovered with freely available tools. Use a verified sanitisation method suited to the drive, or physical destruction.

Who is responsible for data on disposed laptops under UK GDPR?

Your organisation, as data controller, remains responsible. A disposal provider acts as your data processor and should work under a written data processing agreement.

Should I remove hard drives before giving laptops to a recycler?

You can, but it isn't necessary with a provider that verifies and certifies each wipe. Removing drives also stops the laptop being reused, which lowers its value and increases waste.

How to securely dispose of company laptops in the UK

By the Innovate Prime Renew team · Updated 4 October 2026

1. Make an inventory before anything leaves

List every device being retired with its asset tag and serial number. This list is the baseline you'll check the provider's certificates against, and it's the first thing an auditor will ask for.

2. Remove devices from accounts and management

Remove each device from your device-management system (such as Intune or Jamf), unlink it from user accounts, and turn off activation locks. Locked devices can't be reused, which means more waste and less value back.

3. Decide: sanitise or destroy?

Sanitisation removes data so the device can be reused. Destruction physically shreds the drive. Many organisations sanitise by default and destroy only the drives that fail verification, or drives from high-risk systems.

Hard drives (HDD): overwrite every sector, then verify.
SATA SSDs: the drive's firmware Secure Erase command. Overwriting alone can miss spare areas.
NVMe drives: NVMe Sanitize or secure Format at firmware level.
Failed or damaged drives: physical shredding, with the serial recorded first.

4. Choose a provider you can check

Ask for the provider's waste carrier registration number and check it on the Environment Agency's public register. Ask which sanitisation methods they use for each drive type, whether every wipe is verified, and what their certificate lists.

Under UK GDPR your organisation remains responsible for the personal data, so put a written data processing agreement in place before collection.

5. Keep the evidence

Keep the certificate of data sanitisation (listing every drive serial number and result), the collection note, and the waste transfer note. In England, waste transfer notes must be kept for at least two years.

Frequently asked questions

Is deleting files enough before disposing of a laptop?: No. Deleted files and reformatted drives can usually be recovered with freely available tools. Use a verified sanitisation method suited to the drive, or physical destruction.
Who is responsible for data on disposed laptops under UK GDPR?: Your organisation, as data controller, remains responsible. A disposal provider acts as your data processor and should work under a written data processing agreement.
Should I remove hard drives before giving laptops to a recycler?: You can, but it isn't necessary with a provider that verifies and certifies each wipe. Removing drives also stops the laptop being reused, which lowers its value and increases waste.

This guide is general information for UK organisations, not legal advice. For decisions specific to your organisation, check with your compliance or legal team.

More guides