GDPR IT Disposal for Schools and MATs: Why Compliance Demands Proof
It’s time to organise an IT disposal for your school or MAT. The computers have finally been upgraded, so you organise a pick-up from a WEEE recycling service for the old machines. You assume they’ll take care of both the laptops and their data responsibly and correctly, and don’t think anything more of it.
You realise with a start that you were never given any evidence about how the old IT equipment was handled. Despite the sensitive data that these computers contained, you never thought to ask for proof that they would be dealt with correctly.
Even if you have made sure this data is wiped, without any proof, you’re not meeting your obligations under the GDPR.
Your school’s old computers can contain highly sensitive information about pupils – including SEND information and pupils’ contact details – so it’s crucial that they’re treated with the utmost care.
This is key for meeting school IT disposal data protection requirements, encompassed by the GDPR. Specifically, Article 5(1)(f) outlines how organisations must protect personal data against loss or destruction.
Crucially, this obligation continues even during the disposal of your IT equipment – meaning you are still responsible for the data even if you have passed it on to a WEEE contractor. While they might be the ones removing the data, it’s up to you to make sure this is carried out correctly.
What’s more, to stay compliant with the law – according to Article 5(2) of the GDPR – you need to be able to prove you’ve taken these steps and supply the right evidence when asked. This evidence will come in the form of a destruction certificate – more on that later.
Taking matters into your own hands and performing a factory reset of your school’s old IT equipment may well wipe the sensitive data and remove the risk of a breach. But it will not meet the bar set by the GDPR.
This is because you cannot generate any proof that you have deleted this data, and therefore cannot satisfy the GDPR’s requirements under Article 5(2). It’s not enough to give your word that you’ve eliminated this sensitive information, or to rely on the word of the company who handled your WEEE.
You need concrete evidence that the Information Commissioner's Office (ICO) can examine in the event of an inspection. And you can’t create this proof yourself – it can only be supplied by a certified data destruction provider.
To fully meet your responsibilities around IT equipment disposal, the ICO states that your organisation must take ‘appropriate technical and organisational measures.’ What these measures will consist of will reflect the level of sensitivity of the data held on the devices.
An education context, where data could include personal details of students and staff, calls for an extremely cautious approach to deletion. This typically means following established frameworks around data protection.
One commonly used framework is the NIST 800-88r2, which sets out three levels of data sanitisation (Clear, Purge, and Destroy) depending on how sensitive the data is. A standard developed in the US but still widely recognised in the UK.
One other framework that is referenced in the UK is HMG Infosec Standard 5. This has now been superseded by current NCSC sanitization guidance. This is a set of standards and recommendations provided by the National Cyber Security Centre (NCSC) to ensure that data on electronic storage media is securely erased before it is reused, repaired, disposed of, or sent to a destruction facility.
The destruction certificate is the official evidence you need to prove to regulators that you fulfilled your responsibilities around eliminating the data. Again, this document will satisfy Article 5(2) of the GDPR, in the event that the ICO conducts an investigation.
And, in a worst-case scenario where a breach occurs, this certificate will help defend you from legal repercussions by proving you did everything correctly when it came to wiping the sensitive data.
The certificate must include:
You have two crucial responsibilities while disposing of your school or MAT’s IT equipment. One: to act as a steward of your school’s data. Two: to dispose of your WEEE in an environmentally responsible way, including by ensuring it is recycled where possible.
Complying with two different sets of regulations around WEEE and GDPR compliance means you’ll need to collect two separate pieces of evidence. A data destruction certificate will act as proof that the data was destroyed, while an evidence note provided by an Approved Authorised Treatment Facility (AATF) proves that your e-waste was properly recycled or reused.
While they might recycle your school’s old laptops, not all WEEE processors will deal with the data side of the equation. To cover all your bases, and get everything done in the smoothest manner possible, look for an IT disposal partner which offers:
1. Certified data destruction, following a recognised standard such as the NIST 800-88 or the NCSC sanitization guidance.
2. WEEE compliance, with treatment occurring at a named, permitted facility.
3. Documentation, in the form of a destruction certificate and an evidence note, which acts as confirmation that your waste was properly recycled.
Want to streamline the process and rest assured that your school or MAT’s waste and data are being handled correctly?
For a company that can take care of both GDPR-compliant and WEEE-compliant IT disposal at once, talk to GAP.
