The Information Commissioner’s Office says that simply deleting files or turning off an old computer does not make the data on it inaccessible, since even a device that will not turn on can still have its data recovered, and it recommends secure deletion software, physical destruction or a specialist service instead.

Two sets of rules at once

A computer, laptop or hard drive reaching the end of its life is covered by two separate legal frameworks simultaneously in the UK: waste regulations governing how electrical and electronic equipment must be collected and treated, and data protection law governing any personal data still held on the device. Getting rid of an old computer responsibly means satisfying both, not just choosing a recycling route and assuming the data side takes care of itself.

When a computer becomes WEEE

Under UK guidance, electrical and electronic equipment becomes waste, specifically waste electrical and electronic equipment, once the holder discards it, intends to discard it, or is required to discard it. A computer being disposed of is generally treated as WEEE from that point unless specific conditions are met showing it is genuinely being passed on for reuse rather than disposal, such as evidence of an intended buyer, confirmation that only minor repair is needed, and handling and storage that keeps it clearly separate from other waste. Once something is WEEE, mixing it with general waste during transport causes the whole load to be treated as waste, and it must go through an approved authorised treatment facility rather than a standard waste stream.

Why deleting files isn’t enough

The ICO is direct about the limits of ordinary deletion: moving files to a recycle bin and emptying it removes them from plain view but leaves the underlying data recoverable by anyone with the right tools, and a device that no longer switches on is not automatically safe either, since data on its storage media can often still be recovered by someone with access to it. This is the gap that catches people out when a broken laptop or an old hard drive is handed over for recycling on the assumption that a non-working device cannot leak data.

Deletion vs destruction

The ICO draws a specific distinction between data deletion, where information is hidden from normal view but still technically recoverable, and data destruction, where the data cannot be restored even by a specialist. Genuinely getting rid of personal data before a device is passed on for recycling, resale or disposal means achieving destruction in this sense, not just deletion.

The methods ICO actually recommends

The ICO sets out several approaches: secure deletion software that overwrites the data multiple times, which is simple and low-cost; physical destruction of the storage media itself, appropriate where the device will not be reused; a factory reset, though its effectiveness depends on how thoroughly the specific manufacturer’s reset process actually clears data; and using a specialist service that carries out secure deletion or destruction on the owner’s behalf. Cloud-stored data needs a separate step entirely, since wiping the local device does not remove anything stored with a cloud provider, and that has to be handled directly with the provider.

Choosing reuse or destruction

Which method fits depends on what happens to the device next: overwriting with secure deletion software preserves a working drive for reuse or resale, while physical destruction is the more appropriate route for a device being permanently disposed of and not intended to function again, since it removes any possibility of later recovery by destroying the media itself.

What to check with a collector

Because a computer or hard drive is WEEE as well as a data risk, a collector taking it away should be able to confirm both that it will be handled by an approved authorised treatment facility and, separately, what happens to any data still on it, ideally backed by a certificate of data destruction for anything that held personal or business information, kept alongside the waste transfer paperwork for the collection itself.

FAQs

Is deleting my files before recycling an old laptop enough to protect my data?

Not reliably. The ICO says ordinary deletion leaves data recoverable, and recommends secure deletion software, physical destruction, or a specialist service instead.

Does a broken computer that won’t turn on still pose a data risk?

Yes. The ICO specifically notes that a device failing to power on does not mean the data on it is inaccessible to someone with the right tools.

Can I just put an old computer in general rubbish?

No. Once it counts as WEEE it needs to go through an approved authorised treatment facility, not general waste.

Does wiping my laptop also clear my cloud storage?

No. Cloud-stored data needs to be dealt with separately, directly with the cloud provider.

Bottom line

An old computer or hard drive has to be dealt with as WEEE, requiring an approved authorised treatment facility, and separately as a data protection risk, requiring genuine data destruction rather than simple file deletion, which the ICO says is not enough on its own. Checking a collector can confirm both, and getting a certificate of data destruction for anything data-bearing, closes the gap between the two sets of rules. This is general information, not advice on a specific device; the ICO’s own guidance sets out the recommended methods in more detail.

Sources

This guide draws on the following primary sources, current as of 22 September 2026:

• ICO, “Deleting your data from computers, laptops and other devices”
• GOV.UK / Environment Agency, “When electrical and electronic equipment (EEE) becomes waste (WEEE)”

Related guides

Compare Waste Removal is an independent guide. We may earn a fee from some links; this never affects what we write.