Most of this series has been about what happens on screen. This one’s about what happens when the screen is switched off: the old laptop in a cupboard waiting to be “sorted,” the printer in the corner nobody’s logged into in years, the server room door that’s been propped open since this morning’s delivery.

Safe disposal: deleting isn’t erasing

Formatting a drive or deleting a file doesn’t remove the data, it just hides it from casual view, and recovery tools can often retrieve it. The DfE’s Laptops, Desktops and Tablets and Servers and Storage standards both expect disposal to be treated as a genuine security control, not an afterthought:

1. Back up first, to a  new device or cloud storage, before anything else happens to the old one.
2. Factory reset phones and tablets, but treat this as a first step, not a complete solution.
3. Securely erase using software that overwrites the whole disk. HDDs and SSDs need different tools, so check which you’re dealing with.
4. Physically destroy storage media where erasure isn’t sufficient or possible, certified destruction and recycling services for organisations, not a bin bag. Smashing a screen doesn’t erase a phone’s data; the storage chip has to be destroyed.
5. Asset Register. Ensure devices sent for destruction are marked as such on the asset register.

Using a disposal company? Handing devices to a third party doesn’t transfer away the data protection obligation. If they mishandle the erasure, the school is still accountable for the resulting breach. Before signing up with any hardware disposal or IT asset recovery company, check:

• Certification. The relevant UK-specific scheme is ADISA (the Asset Disposal and Information Security Alliance), which publishes its own ICT Asset Recovery Standard and is one of the ICO’s approved UK GDPR certification schemes. Ask whether the company holds current ADISA certification, and at what level.
• A written data destruction certificate for every batch of devices, naming the devices, the method used, and the date, not just a general assurance.
• Chain of custody. How devices are tracked and secured between collection and final destruction, including whether they ever leave the UK before erasure is complete.
• A proper contract, not an informal arrangement. This is third-party data processing, and it needs a data sharing or processing agreement behind it, the same as any other supplier covered earlier in this series.
• Insurance and liability in the event something goes wrong on their end.

A company that can’t produce a certificate per batch, or is vague about where devices physically go, isn’t one to trust with a school’s old devices.

Printer security

A modern printer is a networked device with its own storage, operating system, and firmware, which makes it a genuine target. Multi-function printers keep copies of scanned documents on their internal hard drives; weak default admin settings and unpatched firmware can turn it into an easy way onto a network that otherwise looks well defended.

What actually matters:

• Change the default admin password through the printer’s web interface; the single most commonly skipped step.
• Apply firmware updates the same way you would for any other networked device.
• Segment printers onto their own part of the network rather than giving them the same access as a staff laptop.
• Disable services you don’t use, and review logs periodically.
• Securely wipe internal storage before disposal, using the same standard set out above, a printer’s hard drive holds exactly the kind of data this article is about.

Repurposing hardware

Schools don’t always dispose of old hardware outright. Laptops get reassigned between departments, donated to pupils or families, or recommissioned for a lower-stakes use once they’re no longer fit for their original purpose. That’s good practice environmentally and financially, but it still needs the same discipline as disposal, not less:

• Wipe before repurposing, every time, even for an internal move. A laptop moving from a teacher’s desk to a pupil loan scheme still needs its previous user’s data, saved logins, and cached files removed first.
• Re-image rather than assume it’s clean.  A factory reset alone can leave more behind than people expect.
• Update the asset register to reflect the new assigned user and purpose. Repurposed hardware is one of the easiest ways for a device to quietly fall off the register entirely, especially once it moves outside the main IT inventory process. 
• Check it can still be patched and supported before reassigning it. A device nearing end-of-life for its original use isn’t necessarily safe to hand to someone else just because the use case changed.
• Apply the same account and access controls as any other device. A repurposed device shouldn’t inherit the previous user’s access by accident.

Physical security

Digital controls assume nobody’s getting physical access to the hardware. Once that assumption breaks, encryption, passwords, and MFA all become much easier to work around. The basics:

• Controlled access: key cards, locks, and door entry systems on server rooms and other sensitive areas, not just the main building entrance.
• Surveillance: CCTV as both deterrent and evidence, covering the areas where hardware actually lives.
• Visitor management: logging and escorting visitors, not just handing out a lanyard at reception.
• Environmental controls:  temperature, humidity, and fire suppression for server rooms, where a burst pipe is as damaging as a cyber attack.
• Clean desk policy: notebooks with logins, removable media, and sensitive documents cleared away before people leave their workstation.

CCTV, door entry, and visitor management systems are themselves networked devices, and belong on the asset register covered earlier in this series, not treated as “facilities” and left off it.

Who’s accountable

IT support is Responsible for printer configuration, firmware updates, secure disposal, and re-imaging repurposed devices. Facilities or premises staff are often Responsible for door entry, CCTV, and environmental controls, which is exactly why these need an agreed owner rather than falling through the gap between teams. The SLT digital lead is Accountable for making sure disposal, repurposing, and physical security are genuinely happening, not assumed. The DPO/Data Protection Lead is Consulted on disposal processes, disposal company contracts, and CCTV/visitor data, since all involve personal data. Governors remain Informed.

💡Daily Cyber Tip

Ask whoever handles old devices: when one gets handed down or reused internally, does it get wiped and re-registered first, or does it just quietly move desks? If the honest answer is the second one, that’s worth fixing before the next handover.

Further resources

• NCSC guidance on acquiring, managing, and disposing of network devices
• ICO guidance on deleting data from computers, laptops, and other devices
• ADISA’s ICT Asset Recovery Standard, for checking a disposal company’s certification
• DPE’s Physical Security Learning Nugget and Clear Desk learning nugget