Every business replaces hardware eventually — old laptops go to charity or the skip, phones get traded in, servers get decommissioned. What often doesn’t happen is proper data destruction first. The result is a steady stream of devices entering the world with recoverable customer records, financial data, login credentials, and internal communications still on them.

This is a genuine, common problem. The ICO has issued fines to businesses whose data appeared on second-hand devices purchased on eBay. Data recovery from a “deleted” hard drive is a free download away. And under GDPR, if personal data about UK individuals is recoverable from a device you disposed of improperly, you have a reportable data breach — even if no one actually exploited it.

Here’s what proper device disposal looks like for a small business.

Why “Delete” and “Factory Reset” Are Not Enough

Deleting files or formatting a drive doesn’t erase the data — it removes the pointer to the data and marks the space as available. Until new data overwrites those sectors, the original content is fully recoverable using free tools. Even factory resets on some Android devices and Windows laptops leave data recoverable.

The exceptions:

  • Modern iPhones and iPads: iOS uses hardware-level encryption from first boot. A factory reset wipes the encryption keys, making the data cryptographically unrecoverable. Apple’s “Erase All Content and Settings” is genuinely secure.
  • Modern Android devices with encryption enabled: Similar logic applies — a factory reset on a fully encrypted Android device destroys the keys. But you need to verify encryption was actually enabled before reset, not assume it.
  • BitLocker-encrypted Windows drives: If BitLocker was enabled and the drive is encrypted, reformatting and losing the key means data is cryptographically inaccessible. But again, you need to know BitLocker was actually on and active.

For everything else, assume a factory reset is insufficient and take additional steps.

Hard Drive Destruction: Your Options

Overwrite with dedicated software: Tools like DBAN (Darik’s Boot and Nuke) for HDDs, or shred on Linux, overwrite the disk multiple times with random data. For traditional magnetic hard drives, a single-pass overwrite is sufficient to prevent recovery with consumer tools; the DoD 5220.22-M standard (seven passes) exceeds any practical need. DBAN boots from USB and runs without an operating system. It’s free and appropriate for HDDs being passed on to others.

Important: DBAN and overwrite methods do not work reliably on SSDs. Solid-state drives have internal wear-levelling that routes write operations to different cells. An overwrite command may not reach all the actual data cells. For SSDs, use the manufacturer’s Secure Erase command (built into drives and accessible via tools like Samsung Magician or hdparm on Linux), full-disk encryption followed by key destruction, or physical destruction.

Manufacturer Secure Erase (SSDs): Most enterprise and consumer SSDs support the ATA Secure Erase command, which tells the drive’s controller to reset all cells. This is the recommended method for SSDs being repurposed or donated. Running hdparm --security-erase on Linux (or the equivalent Windows utility) sends this command.

Physical destruction: For drives you’re not reusing, physical destruction is the most reliable option. Professional data destruction companies shred drives and provide certificates of destruction — useful for GDPR compliance documentation. Many provide tracked collection services where a van picks up hardware, destroys it on-site or at a facility, and issues a certificate within 24 hours.

For small volumes, local IT recycling companies often provide this service for a small fee per drive or device. Prices range from £5-15 per hard drive for shredding with a destruction certificate.

Drilling or hammering is not sufficient: Many people believe drilling through a hard drive destroys the data. It doesn’t — it damages platters but leaves readable sectors around the damaged area. A shredder or degausser is required for physical methods to be reliable.

Mobile Phone Disposal

For iPhones: Sign out of iCloud, then go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. Remove the SIM first.

For Android: Enable full-disk encryption if it isn’t already (Settings > Security > Encryption — but most modern Androids are encrypted by default), then perform a factory reset. Remove the SIM and SD card.

Corporate phones managed through MDM (Microsoft Intune, Jamf, etc.) can be remotely wiped through the MDM console, which triggers an encrypted wipe and unenrols the device from management.

Building a Disposal Process

An ad hoc approach — where disposal happens when someone has time, without records — is a compliance problem waiting to happen. A simple process covers the risk:

  1. Asset register: Keep a spreadsheet of business devices with serial numbers. When a device is disposed of, record the date, method, and who handled it.

  2. Pre-disposal checklist: Sign out of accounts (Google, Microsoft 365, email, VPN, cloud storage), remove SIM and SD cards, perform secure wipe or encryption-then-reset, remove from MDM or management platform.

  3. Certificate of destruction: For any professional shredding service, keep the certificate. This is your evidence of compliant disposal for ICO purposes.

  4. Charitable donation: Before donating devices to charity or schools, complete a secure wipe. Charities have been fined for receiving and distributing devices with business data still on them. If you can’t verify the wipe, shred it.

The NCSC’s guidance on secure decommissioning aligns with this approach and is available free at ncsc.gov.uk. Their advice specifically covers hardware disposal for businesses of all sizes and distinguishes between different destruction methods and their appropriate use cases.

Getting this right takes an afternoon to set up as a repeatable process. Getting it wrong can mean an ICO investigation, a fine, and — more damagingly — customer data you were supposed to protect appearing on someone else’s refurbished laptop.