Getting rid of old tech safely: how to wipe phones, laptops and drives before you recycle them

The laptop in the skip

A Greater Manchester accountancy practice called us in last month after one of their partners spotted a familiar-looking laptop at the local tip. Not familiar because it was theirs — familiar because it looked exactly like the one they'd retired two years earlier when the office moved to Windows 11 machines. It had gone out in a batch of "old office bits" to a well-meaning cleaner who took the pile to be recycled.

Sitting in a skip alongside microwave grills and dead kettles, the case was cracked, but the drive was intact. And on that drive, if anyone had been curious enough to pull it, was a decade of what an accountancy practice looks after every day — client tax records, payroll for a handful of employees, saved logins, and eight years of email. Nobody had wiped it. Nobody had a record it existed.

We went back through their cupboards and store rooms with them, pulled everything with a drive in it onto one list — laptops, desktops, an old NAS, half a dozen loose disks, a drawer of USB sticks — and ran one proper batch. Working drives were securely wiped with a written log and a certificate. Dead drives were physically destroyed. The rest of the hardware went for proper WEEE recycling. It took an afternoon. It should have happened years earlier.

Same story keeps happening at home. A Sale family asked us for advice after selling an old laptop on a local marketplace — the buyer messaged back the next day to politely say they'd found several years of tax returns and a saved list of banking passwords in the browser. Nothing malicious happened. It very easily could have.

Why this matters

• At home, old phones and laptops in drawers still hold years of photos, messages and saved logins. If they're sold, stolen or thrown out without wiping, someone else can potentially get to that information — the NCSC's guidance on erasing personal data from mobile devices spells out exactly why.
• At work, devices retired without proper wiping or destruction can leak client data, payroll details and email — which creates a GDPR problem as well as a security one. The ICO's guidance on deleting personal data is very clear: "deletion" has to mean the data actually can't be recovered.

The fix

For most small businesses in Greater Manchester the honest answer is that this doesn't need a big project — it needs one afternoon with the cupboards open, a written list, and one proper wipe/destruction run. After that it becomes routine: any device that leaves the building has to leave the disposal log first. It's exactly the kind of low-drama process that shows up as a green tick in a Cyber Essentials assessment and stops turning into a scramble the next time a client asks about your data-retention practices.

Three things you can do this week

Disposal options, honestly compared

The right choice depends on whether the device still works, whether it held sensitive data, and whether it's yours or the business's. Here's the honest ranking we use when we're clearing a client's cupboards.

What this looks like locally

We help businesses across Tameside, Stockport and the surrounding Greater Manchester area audit their cupboards and store rooms, pull old kit into a single disposal list, and run one proper wipe/destruction batch — rather than drip-feeding risky donations, ad-hoc sell-ons and skip runs over the course of a year. It's usually an afternoon of work that removes a real GDPR risk and comes out the other side with a written record you can put in front of an auditor.

For the wider picture on the boring-but-effective side of good IT hygiene, see our recent piece on what ISO 27001 actually asks of a 20-person company — device disposal is one of the small habits that shows up on the checklist every time.

Frequently asked

Can people really recover data from an old hard drive?

Yes. Even drives that appear blank or won't boot can often be read by anyone with the right recovery tools — most of which are free and freely available. That's why proper wiping or physical destruction matters more than "it looks empty" or "the laptop wouldn't turn on when I checked".

Is a simple delete or "empty recycle bin" enough?

No. Deleting a file usually just removes its listing — the actual data stays on the disk until something writes over it. Free recovery tools can pull those files back weeks or months later. For real disposal you need a full factory reset, a proper wipe, or physical destruction of the drive.

How do I safely dispose of an old phone?

Back up your photos, messages and contacts. Sign out of your Apple ID or Google account — this is the step most people skip, and it's important because it also removes the phone from Find My iPhone / Find My Device. Then run a full factory reset. Only after that is it safe to sell, donate or recycle.

What should a business record when disposing of devices?

At a minimum: what the device was, its serial number or asset tag, roughly what data lived on it, how it was wiped or destroyed, and who did it and when. That short record is what turns a pile of old kit into a defensible GDPR position if you're ever asked — by a client, by the ICO, or by a Cyber Essentials assessor.

Do I need a certificate of destruction?

For businesses handling personal data — client records, payroll, medical, legal — yes, you should get a certificate of destruction from a WEEE-licensed disposal company. It shows exactly what was destroyed and how, and it protects you if a dispute or breach investigation ever looks back at old hardware. For personal home kit it's usually overkill, but for anything work-related it's the sensible baseline.

What about USB sticks and external drives?

Treat them exactly the same way. USB sticks and portable drives get lost, borrowed and left in laptop bags — and they often hold whatever you were working on last. Wipe them properly if you're keeping them, or physically destroy them if you're not. Never just chuck them in a bin or a drawer marked "sort out later".

"For most people, the biggest data leak waiting to happen isn't in the cloud — it's in a box of old kit in the loft." — Brett Casterton, Inology IT

Next tip: Smart-home security — how to keep connected devices from becoming the weak link.