Retiring a batch of business laptops and desktops puts you under two separate sets of law at the same time. The data on the drives falls under UK GDPR. The hardware falls under waste legislation. Most quotes for IT disposal answer one of those properly and mention the other in a single line, and the gap only becomes visible when a client, an auditor or the ICO asks you to evidence what happened.

This guide sets out what your business is responsible for, what paperwork you need to be holding afterwards, and how the services on a typical quote map onto those duties.

IT disposal law in the UK: the two duties you discharge at once

The first is data protection. Under UK GDPR you are responsible for the security of personal data for as long as it exists, and a drive sitting in a supplier’s warehouse still counts. Handing the equipment to someone else does not move that responsibility across. An IT disposal company acts as your processor, which means Article 28 requires a written contract with them and requires you to satisfy yourself before you engage them that they can actually deliver what they claim. If they lose a laptop, you are the one notifying the ICO.

The second is waste. Business IT is commercial waste, and section 34 of the Environmental Protection Act 1990 places a duty of care on you to make sure it is only transferred to an authorised person and is described accurately when it goes. The Waste Electrical and Electronic Equipment Regulations 2013 govern where the material ends up after that. The practical consequence is that you need to check your carrier is registered rather than take their word for it, and you need to keep the record of the transfer.

The five documents that prove your IT disposal was compliant

Five things, and it is worth checking you have all five rather than assuming the supplier sent everything.

• A signed processing contract that meets Article 28, in place before any equipment moves.
• The supplier’s waste carrier registration number, checked against the public register held by the Environment Agency, SEPA, Natural Resources Wales or the NIEA depending on where you are.
• An asset log with serial numbers, recorded at your site and reconciled against what arrived at the facility.
• A Certificate of Destruction, or a verified erasure report, covering every data-bearing unit.
• A waste transfer note, retained for at least two years.

Total Shred issues a Certificate of Destruction on every job as standard, so that item should never be the one you are chasing. The asset log is the one businesses skip most often and regret most. Without serials you can state that forty laptops were destroyed, but you cannot demonstrate that the forty destroyed were the same forty that left your building.

Computer disposal: separating the data-bearing parts from the WEEE

Computer disposal is the simpler half of the job. A tower or all-in-one usually has a removable SATA or NVMe drive that comes out in under a minute, and the rest of the machine holds nothing. The chassis, power supply, monitor, keyboard and cabling go into WEEE recycling streams because there is no data on them to worry about.

That split matters commercially as well as legally. Peripherals and monitors should not be priced at destruction rates, and if a quote lumps everything together at one per-unit figure, ask for it broken out. Total Shred handles computer disposal either on site, where drives are destroyed in front of you before anything leaves, or off site under a tracked chain of custody, and the choice usually comes down to how many machines are involved and whether you need to witness it.

Two things get missed on desktops. Older machines sometimes carry a second drive that was added for storage and forgotten, so an audit at the point of collection is worth more than an audit from your asset register. And multifunction printers, which nobody thinks of as computers, hold an internal drive with images of everything scanned or copied through them.

Laptop disposal: the four points where compliance breaks

Laptop disposal creates more compliance risk than desktops, for four reasons that have little to do with the destruction method.

Storage is frequently soldered to the board or fitted as an M.2 module rather than sitting in a caddy, so the drive cannot be pulled by whoever is boxing the kit up. Either the unit goes through destruction whole, or the module is extracted at the facility and shredded separately. Both are defensible. What is not defensible is a machine going out on the assumption that someone already dealt with the drive.

Batteries add a second obligation. Lithium cells are handled under separate waste rules and need to be removed and processed accordingly, which is also why couriers who are not set up for it will refuse the consignment.

The bigger problem is that laptops move. Desktops sit under desks and appear on the collection list. Laptops go home with people, sit in drawers after someone leaves, and travel between sites. A leaver return that never made it back to the office is the most common way a business ends up with an untracked data-bearing device, and no disposal supplier can fix that for you. Reconcile against HR leaver records, not just the asset register, before you book the collection. Total Shred will take laptop disposal as a whole-unit destruction where the storage cannot be removed cleanly, and lithium batteries are separated and processed under their own waste route rather than travelling with the rest of the consignment.

Full disk encryption helps if a device goes missing, but it is not a substitute for disposal. Recovery keys held in your tenancy, older machines that were never enrolled, and drives that were encrypted after data already existed on them all leave enough uncertainty that the ICO would expect you to have destroyed or verifiably erased the media anyway.

Hard drive destruction or verified erasure: how to decide per device

Destruction is the shorter conversation. The drive is shredded, nothing is recoverable, and the value of the hardware is gone with it. For anything holding special category data or client-confidential material, most organisations accept that trade and move on.

Verified erasure is where the money is. Software overwrites every addressable sector, the tool produces a report per unit, and the hardware stays usable for refurbishment or resale. This only counts as a control if you keep the report. An erasure that nobody documented is indistinguishable from an erasure that did not happen.

Solid state drives behave differently and are worth flagging to your supplier. Wear levelling means a conventional overwrite may not reach every cell, so SSDs need either a manufacturer-supported cryptographic erase or physical destruction. Degaussing does nothing to them at all, because there is no magnetic media to disrupt. It remains fast and effective on mechanical drives, and it kills the drive permanently in the process.

Whichever route you take, the rule to write into your policy is that any drive failing the wipe goes to destruction rather than back into the refurbishment pile. That is how the Total Shred refurbishment programme runs: data is erased by wiping and degaussing before a unit is prepared for reuse, and anything that does not pass is destroyed instead of being pushed through.

National IT disposal: keeping multi-site collections consistent

Once you are running more than a handful of sites, the compliance problem changes shape. The risk is no longer any single collection, it is inconsistency between them: a branch that used a local contractor, a site whose paperwork never reached head office, a regional office that disposed of six laptops informally because it seemed too small to raise a ticket.

National IT disposal is the answer to that, and the phrase is worth being precise about when you brief suppliers. What you are buying is one contract, one method statement applied identically at every location, and one consolidated report you can hand to an auditor without assembling it from twelve inboxes. Some providers describe themselves as national when they hold the contract centrally and subcontract the collections regionally, which is legitimate as long as you know it is happening and the vetting and transport standards travel with it. Ask directly.

For a business with sites across several regions, the practical test of a national IT disposal service is whether it can reconcile every unit back to a single asset register, and whether the certificate you receive for a Scottish site looks identical to the one you receive for a Midlands site. Total Shred operates UK-wide on one contract, which is what keeps the method statement and the paperwork consistent from site to site.

IT asset disposal London: access, ULEZ and lead times

London sites bring logistics that affect cost and lead time rather than compliance. Congestion charge and ULEZ apply to the collection vehicle. Managed buildings usually require a loading bay booking, and many restrict equipment movements to outside business hours. Goods lifts have weight limits that matter once you are moving pallets of towers.

Book IT asset disposal in London with more notice than you would for an equivalent job in a business park, confirm access rules with the building manager before you agree a date, and check whether congestion and ULEZ costs are inside the quoted price or added afterwards. Total Shred covers London as part of its UK-wide service.

IT disposal, IT asset removal and ITAD: what your quote actually covers

Suppliers use different words for overlapping work, which makes quotes hard to compare.

IT disposal is the umbrella term for the whole process, from audit through data destruction to recycling and the paperwork at the end. IT asset removal is only the collection stage: logging, sealed packing and tracked transport from your building to a facility. It is the highest risk part of the job, because the equipment has left your control while the data is still intact, so a quote that covers removal alone leaves the important question unanswered. IT asset disposal services, often shortened to ITAD, describes the full commercial service including the assessment of what can be refurbished and reported value recovery. An IT disposal company is the supplier that carries both sides, acting as your processor for the data and as a registered carrier for the waste, which is what separates it from a shredding firm or a general waste contractor.

Comparing IT disposal companies: the questions that separate them

Most IT disposal companies present a similar certification list, so the comparison has to happen below the surface. The questions that separate them are whether transport is theirs or subcontracted, whether staff are vetted and to what level, what a sample Certificate of Destruction actually contains, whether serial-level reporting is available, and what happens to a unit that fails erasure.

Ask what each standard covers rather than counting logos. ISO 9001 is a quality management standard and ISO 14001 is an environmental one, and neither says anything specific about how confidential material is destroyed. BS EN 15713 does, covering premises security, staff vetting, transport and destruction particle sizes, which is why it carries more weight for this work than a generic certification on its own. Total Shred works to BS EN 15713, ISO 9001 and ISO 14001.

Your IT disposal checklist before the van arrives

Reconcile the collection list against your asset register and your HR leaver records. Note serial numbers for anything data-bearing. Confirm the Article 28 contract is signed and the carrier registration checks out. Agree in writing whether erasure or destruction applies to each category of equipment, and what happens to units that fail. If what you have actually bought is IT asset removal rather than full disposal, pin down now who owns the equipment and the WEEE obligation once it reaches the facility. Decide who at your end signs the collection manifest, and make sure that person compares it to the list rather than signing the driver’s copy at the door.

Total Shred provides secure on-site and off-site IT disposal across the UK alongside document shredding and hard drive destruction, with a Certificate of Destruction on every job and 100% recycling of remaining material. Equipment suitable for reuse goes through the refurbishment programme, with data erased by wiping and degaussing before anything is prepared for a second life. Send through a unit count, a note on how sensitive the data is and how many sites are involved, and we will tell you what the job needs.

 FAQs

What are the legal requirements for disposing of business computers in the UK?

Two apply together. UK GDPR makes you responsible for personal data on the equipment until it is destroyed or verifiably erased, and requires a written Article 28 contract with whoever handles it. Section 34 of the Environmental Protection Act 1990 and the WEEE Regulations 2013 cover the hardware, requiring you to use a registered waste carrier, describe the waste accurately and keep a transfer note.

Do I need both a Certificate of Destruction and a waste transfer note?

Yes, for business IT that holds data. The Certificate of Destruction evidences your data protection position. The waste transfer note evidences your duty of care for the hardware. Different auditors ask for different ones, and neither substitutes for the other.

How long should I keep IT disposal records?

Waste transfer notes must be kept for at least two years. Destruction certificates and erasure reports are worth keeping longer, in line with the retention period for the records that were on the equipment, because that is the window in which someone may ask you to account for them.

Can a business take old computers to a household recycling centre?

No. Household waste recycling centres are for household waste. Business equipment has to go through a registered waste carrier with a transfer note, and anything holding data needs destroying or verifiably wiping first.

Is wiping a laptop enough, or does the drive need destroying?

Wiping is sufficient when the tool overwrites every addressable sector and produces a verification report you keep. For solid state drives, use a manufacturer-supported cryptographic erase or physical destruction, since a conventional overwrite may not reach every cell. For special category or client-confidential data, most organisations destroy and accept the lost value.

Who is liable if an IT disposal company loses a laptop?

You remain the controller, so the ICO notification obligation is yours. The supplier’s liability to you is whatever your Article 28 contract says, which is one reason to read that clause before signing rather than after an incident.

What is national IT disposal and when does a business need it?

It is a single contract covering collections across multiple sites, applying the same process and producing consolidated reporting. It becomes worth it once inconsistency between sites is a bigger risk than the cost of any individual collection, typically from around five locations upward. Total Shred covers the whole of the UK on one agreement, so the same method and the same certificate format apply at every location.

Does encryption mean I can skip secure disposal?

It reduces the risk if a device goes astray, but it does not remove the obligation. Older machines may never have been enrolled, keys may still exist in your tenancy, and data written before encryption was applied may not be covered. Destroy or verifiably erase the media regardless.

What should I ask when comparing IT disposal companies?

Whether transport is subcontracted, how staff are vetted, which standards they hold and what each one covers, what a sample Certificate of Destruction contains, whether serial-level reporting is available, and what happens to a drive that fails erasure. Keep the answers as evidence of your processor due diligence.

How is IT asset disposal in London different?

The compliance position is the same UK-wide. The logistics are not. Expect congestion charge and ULEZ on the vehicle, loading bay booking, goods lift weight limits and possible out-of-hours-only access, all of which affect lead time and price.