Duty of care does not end at the loading bay
Under the Waste Electrical and Electronic Equipment Regulations 2013 and the wider duty of care for waste, handing equipment to someone else does not hand over your responsibility. If your old machines are fly-tipped or exported illegally, the trail leads back to you. Under UK GDPR the same principle applies to the data on them: you remain the controller until it is destroyed.
The five documents to keep on file
- A collection inventory. What was taken, by make, model and serial number. Without it, none of the other documents can be tied to specific assets.
- Waste transfer documentation. Who took the waste, when, from where, and under what licence.
- Your carrier's licence details. Check the operator is a registered waste carrier — it takes a minute on the Environment Agency public register.
- A certificate of destruction. Listing each drive or device, the sanitisation method (for example NIST 800-88 Purge) and the date.
- A downstream statement. Where material goes after your provider: refurbishment, UK recycling, and confirmation of zero to landfill.
How long to keep them
Waste transfer records must be kept for two years. In practice, keep destruction certificates for as long as you would keep evidence of any other data-protection control — most organisations settle on six years, aligned with their wider retention schedule. Store them where the person answering a client security questionnaire can find them, not in one person''s inbox.
Questions worth asking a disposal provider
- Are you a registered waste carrier, and can I see the number?
- Is data destruction done on your own site, and who has access to it?
- Do certificates list serial numbers, or just quantities?
- What happens to equipment you cannot refurbish?
- What is your policy on export?
A provider that hesitates on any of these is not a provider you want on your audit trail.
What Byebyte issues as standard
Every collection produces a serial-numbered inventory, a certificate of destruction covering each data-bearing device, and transfer documentation — all available in your client portal rather than on request. Refurbished equipment is tracked, and nothing goes to landfill.
Book a free collection or read about what NIST 800-88 sanitisation actually means.
