Handing a box of old drives to another company is a moment where you are trusting someone else with your data protection duties. The cheapest quote or the first search result is not a good enough reason to choose. These are the questions worth asking any data destruction company before you book, and the answers that should make you think twice.
Why the choice matters
Under UK GDPR and the Data Protection Act 2018, your organisation stays responsible for the personal data on those drives until it has actually been destroyed. If a drive goes missing between your office and the shredder, or is resold with data still on it, "we used a contractor" is not a defence on its own. When another organisation handles personal data on your behalf, the law expects you to choose one that can give sufficient guarantees about security, and to have a written agreement setting out what it will do. So the questions below are not box-ticking: they are how you show you chose carefully.
1. How is everything counted when it leaves your building?
The most common gap in a disposal is not the destruction itself but the handover. Ask how items are recorded at collection. A good answer is that each drive or device is listed by serial number (or asset tag) before it leaves, and you get a copy of that list to sign. A vague answer, such as "we count the boxes", means you will never be able to prove later that a particular laptop drive was destroyed.
It also helps to do your own count first. Pull the list from your asset register, and check it against what is physically in the cupboard, including loose drives, spares, and the drives inside printers, NAS units and old servers that people forget.
2. What happens between collection and destruction?
Ask who carries the equipment, in what kind of vehicle, and where it goes. Useful details include whether drives travel in locked or sealed containers, whether the vehicle goes straight to the destruction site or makes other stops, and how long items may sit in storage before they are processed. Anyone transporting waste for a business in England should be registered as a waste carrier with the Environment Agency, and you can check that registration on the Environment Agency's public register.
If your data is particularly sensitive, ask whether destruction can be done on your premises instead, so the drives never leave. Some organisations prefer to witness the process; ask whether that is possible and how it is arranged.
3. Which method will be used for each type of media?
Not every method suits every device. Degaussing works on traditional magnetic hard drives and tapes, but it does nothing to the flash memory in SSDs, phones and USB sticks. Software erasure can be appropriate for drives that will be reused, but only if every drive is verified and the failures are physically destroyed. Ask the provider to tell you, per media type, what they will do. If they give the same answer for a hard drive, an SSD and a phone, that is a warning sign. Our guide to wiping vs degaussing vs shredding explains the differences in more detail.
4. Do they do the work themselves?
Some companies take the booking and the collection, then pass the equipment to someone else. That is not automatically wrong, but you should know about it, because each extra handover is another point where something can be lost. Ask whether any part of the job is sub-contracted, to whom, and whether the sub-contractor is covered by the same written terms.
5. What will the certificate show?
A certificate of destruction is your evidence if the ICO, an auditor or a client ever asks what happened to a device. Ask to see a sample before you book. It should identify your organisation, the date, the method used, and each item by serial number, not just "1 box of hard drives". It should be possible to match it line by line against the list made at collection. Our article on what a certificate of destruction should include covers the detail and how long to keep it.
6. Are they registered with the ICO?
Organisations that process personal data generally need to pay the data protection fee to the Information Commissioner's Office, and the ICO publishes a public register of fee payers. Ask for the registration number and check it yourself on the ICO website: it takes a minute and confirms the company is who it says it is. Registration is not a quality mark, but a destruction company that is not registered at all should prompt more questions.
7. What happens to the remains?
Shredded drives and old equipment are still electrical waste. The WEEE regulations govern how waste electrical and electronic equipment is handled, and you should expect the shredded material to go for recycling rather than general waste. Ask where it goes and whether you can have a record of that. If you have a sustainability report to write, this is information you will need anyway.
Red flags
- No list of serial numbers at collection, or reluctance to provide one.
- A certificate that only gives a weight or a number of boxes.
- "We wipe everything", with no mention of verification or what happens to drives that fail.
- No clear answer on where equipment is taken or who handles it.
- Offers to buy your old equipment for resale without explaining how the data will be removed and proven removed.
- No written terms, or terms that say nothing about data.
Write down what you agreed
Whoever you choose, keep a short record with the disposal file: the quote or terms, the collection list, the certificate, and a note of the checks you made (waste carrier and ICO registration, sample certificate seen). If a question ever comes up months later, that file answers it without anyone having to remember.
How we work
Data Destruction London is a division of Creative IT, based at 80 Willow Walk, SE1. We use government-approved destruction methods, issue a certificate of destruction for every job and are registered with the ICO (registration ZA060744). You can read more about our data destruction service, ask us any of the questions above before you book, or call 020 7064 4996. When you are ready, book a collection.