Old laptops, Chromebooks, staff PCs and servers can hold pupil and staff data for years. Here is how to retire them safely and keep the evidence your DPO needs.
Free, DBS-checked, documented.
UK GDPR requires personal data to be processed securely, using appropriate technical and organisational measures (the ‘integrity and confidentiality’ principle). The ICO’s guide to data security applies for the whole life of the data — a laptop in a cupboard waiting for collection is still holding personal data.
The Department for Education’s Data protection in schools guidance covers record keeping, retention schedules and managing breaches. A lost or improperly disposed-of device can become a reportable personal data breach.
1. Audit. List devices to be retired against your asset register — make, model and serial number.
2. Store securely. Keep retired kit locked away until collection.
3. Use a registered carrier. Check the Environment Agency public register (ours is CBDU444714).
4. Destroy, don’t delete. Use certified wiping or physical shredding — not a factory reset.
5. Keep the evidence. File the waste transfer note (GOV.UK says keep it for 2 years) and the Certificate of Data Destruction, and reconcile serial numbers against your audit.
Discreet, DBS-checked collections arranged around term dates and holidays; every data-carrying device wiped to NSA/CSS 130-2, DoD 5220.22-M and HMG IS5 standards or physically shredded; a Duty of Care waste transfer note; and a single Certificate of Data Destruction listing every device by serial number — all free of charge with no minimum quantity.
Read more on our schools & universities page, or see the WEEE paperwork guide.
This guide summarises ICO and DfE guidance as at October 2026 and is not legal advice. Speak to your DPO about your school’s specific policies.
Yes. If a device holds personal data about pupils, parents or staff, the school remains responsible for keeping that data secure until it is destroyed.
Certified wiping makes data unrecoverable on working drives. We wipe to NSA/CSS 130-2, DoD 5220.22-M and HMG IS5 standards, and physically shred any drive that cannot be safely wiped.
The Duty of Care waste transfer note and a Certificate of Data Destruction listing every device by serial number — ideally matched against your asset register.
Yes. We offer discreet, DBS-checked collections arranged around term dates and holidays.
Book a free, DBS-checked collection — data destroyed, certificate for your DPO, nothing to pay.
