Disposing old devices without leaving business data behind

Retire a business device in this order: transfer required work, remove account access, find every storage component, sanitise or destroy the media, verify the result, then release it for reuse, return or recycling. Keep it under business control until its data handling is resolved.

Identify each item and its route

Confirm records the business must keep sit in their approved location and are usable by an authorised person. Before resetting a phone or computer used for sign-in, move any authenticator method needed to reach work accounts.

Remove the retiring device from trusted-device lists and management systems where appropriate. For leased or supplier-managed equipment, agree on the provider’s data-handling steps and the evidence it will return before collection.

Preserve work and move access

Record every computer, phone, tablet, printer, drive and memory card by asset ID or another reliable description. Note whether each item will be reassigned, sold, returned to a lessor, donated or recycled.

Check for local files, cached mail, saved sign-ins, scanned documents and network settings where relevant. Find SIM cards, SD cards, USB storage and discs, and handle each separately.

Where the Privacy Act 1988 applies, APP 11.2 requires an entity to destroy or de-identify personal information it no longer needs, unless a law requires it to be kept. Check retention duties before choosing a release route.

Name one person to approve release and one to carry out or oversee the technical work.

Sanitise the device and its media

Use the current maker or platform instructions for the exact model and storage type. Before disposal, preserve needed information and remove removable media; a reset is a process to perform and check, not a guarantee that every storage component was cleared.

Deleting files or signing out is not evidence of sanitisation. For media intended for reuse or resale, use a verified sanitisation process aligned with NIST 800-88; physical destruction of the storage media is another route when erasure is unsuitable.

For suitable storage media, eWaste Sydney uses Blancco Drive Eraser. Successful erasures can produce device-specific reports with drive serial numbers, sanitisation results and verification details.

Solid-state storage and failed drives may need a method suited to that media. Printers and multifunction devices can contain storage or settings as well as removable media, so ask the maker, print provider or a suitable specialist how to handle the particular unit.

If erasure fails or cannot be verified, keep the media secure and arrange appropriate physical destruction before release.

Verify the hand-off

For each asset and removable item, record who checked retained work, the storage components found, the method used, its result or error, who checked that result, and the release date and recipient. For software erasure, match the successful result and any report to the device’s identifying details.

Ask a disposal provider for item-specific evidence that identifies the asset, states what was done and gives the result. Shred-X says it holds ISO and AS/NZS 5377 accreditations and NAID AAA certification; ask providers which credentials apply to their service and obtain evidence for the particular item.

For computers and televisions, check the Australian Government’s National Television and Computer Recycling Scheme and its information for householders and small business when choosing a recycling hand-off. Sanitise or destroy storage before release; recycling does not establish that data was erased.

Remove identifying labels after matching the internal record to the item, and keep custody clear until hand-off. If data cannot be cleared for resale, record the changed route and deal with the media before releasing the rest of the equipment.

Australian E-Waste Recycling Compliance