The cheapest data leak we've ever seen in a Polish SME cost the company zero zloty. Someone handed three old laptops "for scrap" to a friend who dealt in electronics. A month later the company's financial data landed on a competitor's desk. The hardware wasn't insured, no backup helped, and GDPR doesn't accept "my friend promised he'd format them" as a defence.
IT hardware disposal isn't a topic that comes up in the weekly meeting. Not until it blows up. That's when it turns out nobody actually knows where the drives pulled from the old server three years ago are, who took away the old printers, and why the CEO's phone, sent in for repair, never came back.
What actually walks out of the company with the hardware
IT hardware is not a metal box. It's a storage medium. And on that medium sit several layers of data that most SME owners don't even remember are there.
- Employee laptop — browser cache with remembered passwords, local OneDrive copy, Outlook mail history, API keys to external systems, VPN client certificates.
- Drive pulled from a server — entire ERP databases, backups, snapshots of the last few months, config files with plaintext passwords.
- Company phone — the whole WhatsApp history with clients, quick photos of documents, scanned copies of IDs, banking apps.
- Multifunction printer — an internal hard drive with a buffer of the last few thousand scanned documents. Almost nobody knows that drive is even in there.
- Router or firewall — configuration with VPN credentials, site-to-site VPN keys, external vendor access.
Hardware handed off without a procedure is your company catalogue served to a stranger on a plate.
A real example: a law firm, 14 people, 8 drives
At one of our clients — a 14-person law firm — a file server had to be replaced after two years of use. The previous IT vendor sent 8 drives to "ecological disposal". The firm even got a nice piece of paper with a stamp. A year later we ran an audit: the firm bought identical drives, sent them to an independent lab and asked for a recovery attempt. Three out of eight drives were recoverable to 100% — full client files, court correspondence, contract drafts mid-negotiation. The paper said "destroyed by method X". Reality said otherwise.
Cost of the "disposal service" — about 40 zloty per drive. Cost of a potential GDPR fine plus losing one corporate client if the data had leaked — hundreds of thousands. The economics are obvious once you actually calculate them. The problem is that almost nobody calculates them before an incident, only after.
Three wipe methods — and which one actually works
Not every "drive wipe" is equal. There are three methods commonly used in SMEs, and their effectiveness is very different.
Quick format or "file deletion". This is not wiping. It's removing the entry from the index, but the files are still physically on the drive and can be recovered in minutes with free software. Zero protection.
Data overwrite (data wipe). Software writes random zeros and ones over every sector of the drive, typically in several passes. For a classic HDD that's enough. For an SSD, not necessarily — SSDs have a flash translation layer (FTL) that spares cells and doesn't always physically overwrite what the OS thinks it does.
Crypto-erase, plus physical destruction for sensitive hardware. The drive was encrypted from day one (BitLocker, FileVault, self-encrypting drives), so destroying the key turns the whole content into noise in one move. For drives holding sensitive data (law, accounting, medical) add physical destruction on top: an industrial shredder or drilling the platter. Documentation with the serial numbers of the drives actually seen going into the shredder.
Practical rule for SMEs: encrypt every company drive from day one. Then retiring hardware becomes trivial instead of an emergency.
A playbook you can roll out in a day
You don't need a 40-page procedure. You need a handful of moves you perform every time hardware leaves the company.
- Inventory before disconnecting. Serial number, type, who used it, what data was on the device. An entry in a register, even in a simple spreadsheet.
- Detach from systems. Remove the account from Active Directory / Entra ID, revoke certificates, invalidate tokens, cut VPN access. Before the hardware physically leaves the office.
- Wipe the data with the method that fits the medium. HDD — overwrite. SSD and NVMe — crypto-erase or firmware secure erase. Phone — factory reset plus MDM unenrol. Printer — reset the internal drive (vendor instructions, usually one service procedure).
- Document it. Who, when, which serial number, which method. The paper stays in the company for at least five years.
- Only now hand the hardware on. For resale, for scrap, to a foundation, to the employee. Never the other way round.
Step two is the crucial one and the most often skipped. When an employee hands back a laptop and you don't disable their VPN account for three weeks — that account works exactly as it did while the laptop was still with them. The hardware leaves; the access stays.
When the hardware is beyond resale
There are two scenarios where reselling or handing off simply isn't worth the risk. Hardware that processed particularly sensitive data (medical, legal, biometric, personal data from clients in regulated sectors). And hardware whose medium can't be reliably wiped (a damaged drive the software can't see in full; an older SSD without firmware secure erase; a controller that stopped responding).
Then there's one route: physical destruction at a certified vendor, with a report containing drive serial numbers, photos of the result and a technician's signature. Cost — a few dozen zloty per drive. Much cheaper than the message "we have your data, pay for our silence".
The paperwork that actually protects you
A single-page "disposal certificate" with a vendor stamp isn't a document. A document that will hold up against GDPR enforcement and a corporate client's audit has several concrete elements:
- A list of serial numbers for every destroyed or wiped medium.
- The method used per medium (overwrite, crypto-erase, degauss, shredding).
- Date, place, name and signature of the technician who did it.
- Photos (for physical destruction) or the wipe software log (for wipes).
- A link to your own asset register — so an auditor can trace an asset number to proof of destruction.
If a vendor refuses to issue that document, they're telling you they don't trust themselves either. Find another one.
What to do this week
If nobody at your company can tell you in five minutes where the drive pulled from the server last year is right now and what its wipe procedure was — that's the signal to start with one simple step: inventory the hardware that's been taken out of use. Everything sitting in a cupboard, in the archive, in a vendor's warehouse. Serial numbers, status, next step.
The rest will settle once you know what you have. If you don't know where to start, we help SMEs sort this out regularly. The first call is free and takes half an hour.
Hardware that left the company without documented media wiping is still working — just for someone else.