Disposing of Business IT Equipment: A UK Legal Guide

A business can't put old computers in a skip or hand them to anyone with a van. Two sets of rules apply at once: waste law covers the equipment, and data protection law covers what is stored on it.

1. Your waste duty of care

Under section 34 of the Environmental Protection Act 1990, every business has a duty of care for its waste. In practice that means three things:

  • Use a registered waste carrier. You can check a carrier on the public register.
  • Make sure the waste goes to a site authorised to take it.
  • Complete a waste transfer note for each load and keep it for at least two years.

The duty stays with you. If your equipment is later found fly-tipped, the paperwork is your evidence that you acted properly.

2. WEEE and hazardous items

Old IT equipment is waste electrical and electronic equipment, known as WEEE. It should be treated at an Approved Authorised Treatment Facility, or AATF, which is approved by the environmental regulator to treat WEEE to a set standard.

Some items count as hazardous waste, including older monitors and equipment containing certain batteries. These move under a consignment note, which must be kept for at least three years.

3. Data protection

Under UK GDPR your business remains responsible for personal data until it is destroyed. A drive that leaves your building with customer or staff data still on it is a data breach waiting to happen.

Formatting a drive or deleting files does not remove the data. Drives should be sanitised to a recognised standard, such as NIST SP 800-88, or physically destroyed. Ask for a certificate that lists each drive by serial number.

The paperwork to keep

Document What it proves Keep for
Waste transfer note The waste went to an authorised carrier At least 2 years
Hazardous waste consignment note Hazardous items were moved correctly At least 3 years
Asset register Exactly which items left your site With your asset records
Certificate of data destruction Each drive was sanitised or destroyed With your data protection records

Questions to ask a recycler

  1. Are you a registered waste carrier, and what is your registration number?
  2. Are you an AATF, or do you pass equipment to one?
  3. Is data destruction done by your own staff at your own site?
  4. Will I get a certificate listing every drive by serial number?
  5. Do you pay a rebate for equipment with resale value?

Sierra Indigo is a registered waste carrier (CBDU030506) and an AATF approved by Natural Resources Wales (WEE/NR0026WA/ATF). All data destruction is done in-house, and every collection comes with the full set of documents above. See our computer recycling and ITAD services.

This guide is a summary for general information and is not legal advice.

Back to blog