‘Clear out your cupboards, clear out your data’

Security and compliance for IT Asset Disposal (ITAD)

Is your organisation is missing the opportunity to reuse IT through lack of awareness?

Every IT Manager’s major concern is cyber security and data safety.

No doubt, then, that this is why destruction of data bearing devices is often prioritised when it comes to end-of-life IT asset disposal.

But the destruction of recyclable and reuseable materials is a wasted opportunity for the organisation’s ESG strategy because many of these redundant IT items could be securely data erased, reconditioned, and streamed into reuse before ending up in recycling centres.

Which of these statements applies to your business when it comes to dealing with end-of-life IT equipment?

We don’t reuse or recycle our redundant IT because we’re worried about data breaches.

We use a shredding company for data bearing devices, but we want to look into reuse and recycling.

We need to find a responsible partner/provider but are not sure where to start.

We have old IT/electronics in storage because we just don’t have the time to deal with it.

We just want someone to sort out our end-of-life IT for us but don’t know what the regulations are.

Data Security and WEEE – your organisation’s obligations for waste IT equipment

No matter what kind of industry, business or organisation you work in, data protection obligations and hazardous waste regulations mean that you cannot just put your old laptops and phones in the bin.

The UK’s Waste Electrical and Electronic Equipment Regulations (WEEE) which came into force in 2013 require that electrical/electronic waste is disposed of by businesses in an environmentally friendly way, prioritising reuse over recycling.

However, with cyber security a major concern, the single most important issue to get right when it comes to managing IT Asset Disposal (ITAD) is data eradication.

Whilst most IT Managers’ priority is usually destruction when it comes to end-of-life hard drives, servers, USB sticks etc. but what happens next with redundant data bearing devices? Does data destruction automatically lead to an environmentally sustainable solution for the other materials? Is the focus on recycling or reuse?

4 steps to best practice for embedding reuse into your IT asset disposal policy.

1.  Develop a comprehensive and sustainability-focused policy for end-of-life IT assets
Designating this project to a team/individual is the first step to responsible IT asset disposal. From asset audit to filing reports, the policy should incorporate a transparent flow of information that holds up against investigation and evidences compliance. The policy should reflect the regulations required for your industry and follow the waste hierarchy.
Include the following points:
– Audit assets: serials numbers, storage location, age and state
– Identify potential for internal reuse
– Record employee login details where appropriate
– Seek appropriate data erasure methods for data bearing devices, avoiding destruction/shredding
– Identify reuse channels (after secure data erasure and for non-data bearing devices) for resale or donation
– Research external IT asset disposal service provider/s to fulfil data destruction and recycling needs as a last resort.

2.     Ask an IT asset disposal service provider the right questions. For example:
– How can you help us to prioritise reuse over recycling?
– What accreditations do you have? (ISO 9001, ISO 27001)
– Is data wiped with software approved by the UK’s National Cyber Security Centre?
– How is IT equipment tracked during transit?
– Is the transport fleet GPS-tracked?
– How are data bearing devices destroyed?
– Is data destruction compliant to BS EN 15713 Standard?
– Can we see your waste carrier’s licence number?
– Are staff security-cleared?
– What reporting and certification do we receive?

3.    Prioritise reuse – resale and/or donation
Correctly handled, once data bearing devices are securely wiped of information, they can then be reconditioned and tested to make them suitable for reuse. Your ITAD (IT Asset Disposal) policy could include reuse through one or both of the following channels:

• Resale where items are suitable to be sold with a rebate to your organisation, or
• Donation should you wish to give back to a charity partner as a social value gesture from your business to your community.

4.   Final stage: choose a zero-to-landfill recycling partner
Once reuse potential has been optimised, any waste materials should be sent for recycling. Partner with an organisation which offers a zero-to-landfill policy to ensure that all plastics, metals, toxic substances or valuable components have been extracted and deposited in the relevant waste stream.

Crown Workspace’s end-to-end, compliance assured services

Crown Workspace has developed a UK and EU compliant, end-to-end service for IT asset disposal (ITAD) to help organisations meet all legislative and regulatory requirements.

Our Renew IT team works with all sorts of industries, from public sector to corporate and NGO, and our clients range from SMEs to global corporations, to fill in the gaps when it comes to clearance, data eradication, reuse and finally, zero-to-landfill recycling.

Our services include:

IT asset auditing: on-site and off-site audits and inventories of IT assets by an expert from our team, to help you manage redundant end of life IT assets on an ongoing basis.

GDPR compliant IT asset disposal: Secure collection using GPS-tracked vehicles and vetted staff with a transfer chain of custody at point collection to ensure GDPR compliance.

Secure data destruction: By our trained staff at clients’ sites, or at our dedicated facility, using specialist software certified by the National Cyber Security Centre for use on magnetic hard drives.

Physical destruction of data-bearing devices: At clients’ sites or off-site with one of our vetted and accredited data destruction partners; in accordance with BS EN 15713 Standard (destruction of confidential information standard).

Reuse ready: Testing, reconfiguring and repairing for redeployment and reuse to minimise the environmental impact and maximise any potential financial or social value.

Re-marketing of reconditioned IT assets: Through our trusted resale partners or our own direct sales routes, we can sell reconditioned IT assets on a pre-agreed and transparent revenue-sharing agreement.

Reuse of reconditioned IT assets: We can also offer alternative reuse options for your retired IT assets. We can facilitate employee buy-back programmes or redeploy IT assets back into your organisation (fully data wiped or loaded with new software).

Charitable donation of reconditioned IT assets: Our well-established donation initiative, the Giving Back Project, enables you to give back to society by donating end-of-life or retired IT assets to schools, charities and social enterprises. As a Microsoft Registered Refurbisher, we are authorised to install Operating System and Office package on reconditioned IT assets for pre-qualified organisations at a fraction of the retail cost. We have an established network of partners who ask for our donations, or we can also help to liaise with our clients’ own charity partners.

Recycling via licensed WEEE partners: Where IT assets are not suitable for reuse, we extract component parts for reuse on items in the future. Those parts not retained are recycled with one of our fully accredited recycling partners, with a zero-to-landfill policy.

Reporting: You will receive a full audit trail, including data destruction certification, an itemised report with all corresponding asset serial numbers, asset tags and asset specifications. All electrical equipment is returned on consignment notes in order to comply with the Waste Electrical and Electronic Equipment Regulation 2013. Also included are details of savings from reuse, resale and rebates, a list of your donations and the charities supported, and the carbon savings achieved by using our services.

*image taken from GOV.UK waste hierarchy graphic