The Van Is Not the End of the Chain: Auditing Retired Drives Before They Leave

Disposal has a reassuring shape. A van arrives, boxes are lifted, a signature is taken, and the cupboard is clear. The trouble is that the van is not the end of the chain. It is the point at which the organisation stops looking. For UK SMEs, the practical question is not whether a supplier says data has been destroyed, but whether the business can connect a specific drive, phone or laptop to a specific method, date and sign-off.

That connection is what a retirement audit should test. It need not be a large project. One afternoon, a register and a short walk around the building will usually show whether the evidence trail is intact or whether disposal is being managed by memory and bin bag.

Start with the drawer, not the manifest

The manifest is the easy part. It lists what the supplier collected. The harder part is what the business kept, forgot or removed before collection. Old SSDs sit in drawers because they were upgraded. Phones remain in a cupboard because a contract ended. Laptops are stripped of drives by well-meaning staff and the drives are then stored without labels. Multifunction devices and printers may hold storage too.

The audit should therefore begin with a physical sweep of known storage points: IT stores, locked cupboards, meeting rooms, finance archives and any area where decommissioned kit is parked. Record every data-bearing item, including those not yet scheduled to leave. A simple entry is enough: asset tag, serial number, device type, location, apparent condition and intended route. The aim is not a perfect asset register in one sitting. It is to expose the gap between what is known and what is actually present.

Give every asset class an exit route

Not all retired equipment needs the same treatment. A monitor without storage is a WEEE stream, not a data problem. A laptop with an encrypted SSD may be suitable for internal reuse after a verified wipe. A failed phone may need physical destruction. A shared drive from a closed project may need both sanitisation and a record of the project it served.

The audit should assign one of four routes: internal reuse, resale, recycling through an authorised treatment facility, or physical destruction. Each route needs its own evidence. Resale without a wipe record is simply a data transfer. Recycling without a waste transfer note is an incomplete WEEE record. Destruction without an asset-level certificate is a claim that cannot be tied back to the device.

The wipe is a method, not a mood

A quick format is not sanitisation. Deleting a partition is not sanitisation. Removing a drive and putting it in a box is certainly not sanitisation. The audit should check that the method used matches the storage type and the sensitivity of the data. Hard drives may be overwritten to a recognised standard or destroyed physically. Solid-state drives need manufacturer-supported secure erase or cryptographic erase where available, because overwrite tools can miss cells and wear-levelling areas.

For phones and tablets, a factory reset is only credible when it is tied to the device and, where possible, to the account removal that preceded it. For encrypted devices, crypto erase can be acceptable if key management is understood and the encryption was active before the data was written. The audit does not need to re-run every wipe. It needs to see that someone recorded the method, the tool and the result, and that the record names the asset rather than a batch.

What a sanitisation certificate should actually say

A certificate with a company logo and the words data destroyed is not enough. A useful certificate should identify the asset by serial number or asset tag, state the storage type and the sanitisation method, and give the date and location of processing. It should name the standard or procedure followed, the operator or processing organisation, and a responsible signatory. Where the item was physically destroyed, the certificate should say so and describe the form of destruction.

There is a difference between a certificate of sanitisation and a certificate of destruction. The first says data was removed by a defined process. The second says the medium no longer exists in a readable form. Both can be valid, but they answer different questions. The audit should check that the certificate matches the route actually taken and that the serial numbers reconcile to the collection manifest. A generic certificate covering a mixed load is a weak link unless it is supported by an itemised schedule.

For third-party processing, BS EN 15713 is a useful reference for secure information destruction, but it is not a substitute for checking the scope and the asset list. An ISO 27001 certificate tells you something about a management system. It does not tell you that drive serial number ABC123 was wiped on a particular Tuesday.

Tie disposal to WEEE and UK GDPR

Retired equipment is waste, and the WEEE Regulations apply. A UK SME disposing of its own kit should use an authorised route and keep the waste transfer note or equivalent record. Batteries and other hazardous components need their own care. The audit should check that the WEEE paperwork and the data sanitisation paperwork describe the same collection, not two unrelated stories.

Under UK GDPR, the obligation is accountability. The business must be able to show that appropriate technical and organisational measures protected personal data through the disposal process. The ICO does not issue a certificate for every wiped drive, and it does not require a particular form. It does expect the organisation to know what happened. A register that links asset, data classification, method, certificate reference and WEEE note is proportionate evidence for most SMEs. A folder of undated certificates with no asset list is not.

A one-afternoon audit sequence

Begin by pulling the disposal records for the last twelve months: collection notes, certificates, transfer notes and any internal wipe logs. Then walk the storage areas and list every data-bearing item you can see. Reconcile that list against the records. Look for devices that left without a serial number, certificates that do not match the manifest, and items still in the building that were assumed gone.

Next, sample three or four assets across different routes. For each, ask one person to show the chain from retirement request to final record. If the answer depends on an individual remembering which box was which, record that as a finding. Finally, write a short action list: label the drawer, appoint an owner for the disposal register, require asset-level certificates in the supplier contract, and set a quarterly reconciliation. The point is not to create paperwork for its own sake. It is to make the evidence survive staff changes.

The record that outlasts the van

A bin bag is not a certificate. A collection note is not a wipe log. The van is not the end of the chain. What remains after the equipment has gone is the record, and that record is only useful if it names the asset, the method and the person who accepted it. For a UK SME, an afternoon spent testing that chain is usually enough to find the forgotten SSD, the unsigned certificate or the missing transfer note before it becomes a much harder conversation.