Is there a policy or any regulatory requirements in the disposal of computer equipment when it comes to the end of its life? Do we require certificates to confirm that this has been disposed of in a secure way so that we are compliant?

This Q&A looks at Personal data held on equipment to be disposed of and does not consider the position under any environmental, landfill or waste laws.

In this Q&A we have focussed solely on the current English law under the Data protection Act 1998 (DPA 1998) as regulated by the UK’s Information Commissioner’s Office (ICO). We have not considered any sector or industry specific laws, regulations, polices, codes or guidelines (such as any applicable to public sector bodies, public electronic communications services, electronic communications services, firms regulated by the Financial Conduct Authority or by the Solicitor’s Regulatory Authority, the payment card services industry or businesses subject to any foreign laws or regulation).

We assume that in disposing of the equipment, any personal (or other) data has been backed up elsewhere so the anticipated destruction of equipment