GDPR and Device Disposal: What UK and EU Businesses Must Do Before Selling Old Stock

The GDPR Risk in Device Disposal

Every mobile device that has been issued to an employee, customer, or service user may contain personal data — emails, contacts, login tokens, cached documents, photos. Under GDPR and the UK Data Protection Act 2018, organisations are obligated to ensure that personal data is not accessible once a device leaves their control.

Which Businesses Face This Risk?

The risk applies to any organisation that issues or handles mobile devices:

• Employers disposing of company-issued handsets at end of lease
• Network operators handling returned customer devices
• Insurance companies processing claimed and replaced devices
• Retailers processing consumer returns and trade-ins
• IT asset disposal companies acting on behalf of any of the above

What Counts as Adequate Erasure?

The UK ICO and EU data protection authorities have consistently held that a factory reset is not sufficient for GDPR compliance on a device being sold or transferred. Adequate erasure requires certified overwriting of all storage using a recognised standard, or physical destruction of storage media.

Documentation Matters

For corporate device disposal, you need a paper trail. Certified erasure software like Blancco generates per-device erasure certificates that you can retain as evidence of compliance. This is particularly important if you are ever subject to a data breach investigation — being able to demonstrate certified disposal protects your organisation.

HK Saitong's Data Wiping Service

We offer certified data wiping as part of our intake process for bulk lots. Devices are wiped on arrival to recognised standards with documentation available on request. This allows sellers to fulfil their data disposal obligations without needing to invest in erasure software themselves. Ask about this when you contact us via WhatsApp.