Chapter 05 · 8 min read
Legal duties and evidence
Two separate regimes apply at the same moment. Data protection law covers what’s on the media; environmental law covers the physical waste. Failing either is your liability, not your supplier’s.
05.1Part one: the data
You stay the controller
Handing equipment to a disposal company does not transfer your responsibility for the personal data on it. You remain the data controller. Your supplier is a processor acting on your instructions, which means you are accountable for choosing one that offers sufficient guarantees, and for being able to show you did.
What the law actually says
UK GDPR Article 5(1)(f) requires personal data to be processed with appropriate security, including protection against unauthorised processing and accidental loss. Article 5(2) adds the accountability principle: you must be able to demonstrate compliance.
That second part is the one that matters for disposal. It is not enough that the drives were wiped — you need to be able to show, years later, that a specific drive with a specific serial number was sanitised by a specific method on a specific date.
Article 32 requires measures appropriate to the risk. No standard is named, which is why NIST 800-88 has become the reference point: it is how the industry evidences that the measure chosen was appropriate.
When disposal becomes a breach
A drive leaving your premises with recoverable personal data on it is a personal data breach. If it is likely to result in a risk to individuals it is reportable to the ICO within 72 hours, and if the risk is high the individuals must be told too.
Enforcement in this area has historically focused on exactly this scenario — equipment sold or scrapped with data intact. It is one of the more avoidable ways to end up in front of a regulator.
What to require from a supplier
- A data processing agreement, or terms that clearly set out the processor relationship
- Per-device certificates naming the method and the verification result
- A written position on what happens to media that fails sanitisation
- Confirmation that they do not access, copy or retain the contents of any media
- Their ICO registration
- Whether any part of the work is subcontracted — each hop lengthens the chain of custody
05.2Part two: the waste
Duty of care
Under section 34 of the Environmental Protection Act 1990 you have a duty of care over waste you produce. In practice it means you must transfer it only to an authorised person, describe it accurately, and keep a record of the transfer.
An authorised person here means a registered waste carrier. Upper-tier registration is what permits a company to transport waste commercially — you can and should check the registration number on the public register. Ours is CBDU607333.
Waste transfer notes
A waste transfer note must be completed for each transfer, describing the waste, giving the appropriate EWC code, and signed by both parties. Keep them for at least two years — most organisations align this with their six-year financial retention.
Without one, your duty of care is not discharged and the liability remains with you, regardless of what the other party did with the equipment afterwards. You can see what a completed one looks like, including the EWC codes used for storage arrays and drives.
WEEE
Waste electrical and electronic equipment carries additional obligations around treatment and recovery. For business users the practical points are that WEEE must go to an appropriately authorised facility, and that reuse is preferred over recycling in the waste hierarchy — something you are separately obliged to apply under the Waste (England and Wales) Regulations 2011.
A T11 exemption permits repair, refurbishment and dismantling of WEEE, which is what allows working equipment to be returned to service rather than shredded. Ours is EXP/KP3143JC.
05.3The evidence pack
Pulling both regimes together, this is what you should have on file at the end of a decommission:
- Waste transfer note for every load, with EWC codes and both signatures
- Certificates of erasure or destruction, per device, by serial number
- A reconciled report matching collected equipment against your asset register
- Copies of your supplier’s carrier registration and treatment exemptions
- Their ICO registration and, if applicable, the data processing agreement
That set answers both an information security audit and an environmental one, which is why we issue all of it as standard rather than on request.
