When a laptop dies or gets replaced, it’s tempting to drop it in a bin, donate it to a charity shop, or leave it in a storage cupboard until someone figures out what to do. None of these are good options for a business. Here’s why — and what you should do instead.
What’s Actually on That Old Laptop?
Even a laptop that’s been “wiped” using the standard Windows reset or macOS erase function may still contain recoverable data. Consumer-level factory resets are not designed for security — they remove file references but leave the underlying data intact on the drive, often recoverable with free tools available online within minutes.
Think about what accumulates on a typical business laptop over 3–5 years of use: email archives, locally saved documents and spreadsheets, browser-saved passwords, cached logins to cloud services, accounting files, client contact lists, HR records, and anything ever downloaded from cloud storage. Even if you moved to cloud-first workflows years ago, local caches and temp files persist.
The Legal Obligation to Destroy Data Properly
Under Australia’s Privacy Act 1988, organisations that hold personal information are required to take reasonable steps to destroy or permanently de-identify that data when it’s no longer needed. “Reasonable steps” for electronic data means using a recognised overwrite or destruction method — not a consumer reset.
If a device you disposed of is later found to contain accessible personal information about clients, employees, or third parties, that is a potential notifiable data breach under the Notifiable Data Breaches (NDB) scheme. You may be required to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals. Fines under the Privacy Act can reach $50 million for serious or repeated breaches.
Common Mistakes Businesses Make
- Windows “Reset this PC” — removes files from the OS but data remains on the drive
- Donating to charity without wiping — a well-meaning gesture that hands over your data
- Leaving devices in storage — deferred risk; the data doesn’t expire
- Assuming the hard drive is broken — even failed drives can be read with data recovery tools
- Deleting files and emptying the Recycle Bin — the most common and least effective approach
What Proper Data Destruction Looks Like
Certified data erasure uses software that writes over every sector of the drive multiple times with defined patterns — making the original data unrecoverable even with forensic tools. The gold standard used by defence and government agencies is US DoD 5220.22-M, which performs three overwrite passes followed by a verification read.
For solid-state drives (SSDs and NVMe), the approach differs — most overwrite tools are designed for spinning hard drives and are less effective on SSDs. Proper SSD destruction uses the Secure Erase (ANSI ATA) command, which resets all memory cells at the firmware level, or physical destruction of the drive itself.
After erasure, a certificate of erasure documents what was destroyed, when, using which standard, and by whom. This is your evidence of compliance.
The Right Way to Handle End-of-Life Business Hardware
- Engage a certified IT asset disposal (ITAD) provider
- Have every device wiped to a recognised standard before it leaves your custody
- Request a certificate of erasure for each device
- Ensure hardware is recycled through an accredited e-waste processor — not general waste
Kinsoft provides secure e-waste collection and certified data destruction for Sydney businesses. We collect from your premises, wipe every drive to DoD 5220.22-M or your preferred standard, and issue certificates of erasure. Learn more about our e-waste removal service.