Schools and colleges hold some of the most sensitive personal data there is — safeguarding records, SEN documentation, medical information, family circumstances — and they refresh IT equipment in bulk, usually in the summer holidays. Those two facts together make end-of-life IT disposal one of the biggest data-protection risks in education, and one of the least discussed. Here’s what a compliant disposal actually looks like.
The problem with the storeroom full of old laptops
Every school has one: a cupboard of retired laptops, a stack of old desktops behind the server cabinet, a box of loose hard drives someone meant to deal with. Every one of those drives potentially holds pupil records, staff files and years of cached documents — and under UK GDPR the school remains responsible for that data until it is properly destroyed. “We’ll sort it out eventually” is a liability accumulating on a shelf.
Why deleting files and resetting laptops isn’t enough
Factory resets and file deletion leave data routinely recoverable with free tools. Compliant destruction means one of two things: certified erasure — overwriting the drive to a recognised standard (every data-bearing device is processed to HMG Infosec Standard No. 5, the UK Government data erasure standard, or NIST 800-88 Clear or Purge) — or physical destruction, shredding or crushing the drive so it can never be read. Erasure suits equipment being reused or resold; physical destruction suits failed drives and the most sensitive data. A school clear-out usually needs both.
The paperwork is the point
For a school, the certificate matters as much as the destruction. Governors, trust auditors and the ICO all expect documented evidence of compliant disposal: which devices, identified by serial number, destroyed when, by what method. A proper provider logs every device and issues a certificate of destruction within days — filed once, it answers the question forever. A van that took the old computers away “for recycling” with no paperwork answers nothing.
What a summer clear-out should look like
1. Inventory — list what’s going: laptops, desktops, servers, loose drives, tablets, and don’t forget photocopiers (they contain drives too). 2. One collection — everything gathered in one documented job rather than dribbling out over months. Collection is free for qualifying volumes — tell us what you have and we’ll confirm. 3. Destruction & certificates — every data-bearing device wiped or destroyed, certificate issued within five working days. 4. Recycling — everything else processed via our sister company Computer IT Disposals, an Environment Agency licensed waste carrier (CBDU457511) — 100% diverted from landfill, which also ticks the environmental box for the sustainability policy.
Paper records too
Schools generate confidential paper at the same rate as data: old pupil files, registers, safeguarding notes past retention, staff records. Our confidential waste shredding service handles archive clear-outs with the same certificate of destruction — and combining paper and IT disposal into one visit is usually the cheapest way to do both.
Based in Nottingham, working across the East Midlands
We provide certified data destruction and free IT recycling collection for schools, colleges and trusts across Nottingham, Derby, Long Eaton and Mansfield. Send us your equipment list — we’ll come back with a fixed quote and a collection date, usually within the hour on school days.
Quick answers
Can schools just delete files before disposing of laptops?
No — deleted and formatted data is routinely recoverable. Drives must be wiped to a recognised erasure standard or physically destroyed, with a certificate as evidence.
Do schools get a certificate of destruction?
Yes — every device is logged by serial number and a certificate of destruction is issued, the evidence your governors, auditors and the ICO expect.
Is collection free for schools?
Collection is free for qualifying volumes — send us the list of what you have and we'll confirm. Smaller quantities — we'll usually still help.