When a Perth business replaces old computers, the old machines often end up in a storeroom, donated to charity, sold on Facebook Marketplace, or thrown in a skip - with business data still on them. Deleting files or even formatting a drive does not remove the data. Here's what proper IT equipment disposal looks like.
Why Deleting Files Isn't Enough
When you delete a file - or even format a hard drive - the data isn't actually erased. The operating system simply marks that space as available to be overwritten. The original data remains on the drive and is easily recoverable using free tools available to anyone.
This means that a laptop donated to charity or sold second-hand, with a “formatted” drive, may still contain: client files, financial records, email archives, passwords stored in browsers, accounting data, and staff personal information. Any of these could constitute a data breach under the Privacy Act if they fall into the wrong hands.
The Right Way to Wipe a Hard Drive
The appropriate method depends on the type of storage:
- Traditional hard disk drives (HDD) - overwrite the entire drive multiple times using a certified wiping tool (DBAN, Eraser, or similar). A single-pass overwrite is sufficient for most business purposes; three-pass meets most compliance standards.
- Solid-state drives (SSD) and NVMe drives - overwriting doesn't work as reliably on SSDs due to how they manage data internally. The correct approach is to use the manufacturer's secure erase tool (which triggers the drive's built-in cryptographic erase function) or to physically destroy the drive.
- Encrypted drives - if the drive was fully encrypted with BitLocker (Windows) or FileVault (Mac) before disposal, destroying the encryption key renders the data unrecoverable without additional wiping steps. This is one more reason to run full-disk encryption on all business devices from the start.
Physical Destruction - When to Use It
For drives containing highly sensitive data - patient records, legal files, financial data - secure physical destruction is the most reliable option. Perth has specialist e-waste and data destruction services that shred hard drives and provide a certificate of destruction, which is useful for compliance documentation.
Physical destruction is also the right approach for drives that are failing or damaged, where software wiping tools may not be able to complete a full wipe.
What to Do Before Disposing of a Device
Before a device leaves your business, work through this checklist:
- Sign out of all accounts - Microsoft 365, Google, accounting software, industry platforms, browsers with saved passwords
- Remove the device from MDM - unenrol it from Microsoft Intune or your MDM platform so it no longer appears in your device management dashboard
- Deactivate software licences - some software licences are tied to a specific device or limited to a certain number of activations
- Remove from Microsoft Entra ID / Azure AD - delete the device object so it no longer appears as a managed device in your tenant
- Wipe the drive - using the appropriate method for the drive type
- Document the disposal - record the serial number, disposal date, method used, and destination. This is your evidence of proper data destruction if ever questioned.
Mobile Phones and Tablets
Mobile devices are frequently overlooked in disposal processes. Before disposing of a phone or tablet:
- Perform a factory reset - on iOS, use Settings → General → Transfer or Reset iPhone → Erase All Content. On Android, Settings → General Management → Reset → Factory Data Reset.
- Remove the device from Find My (iPhone) or Google Find My Device before resetting
- Remove the SIM card
- Unenrol from MDM if enrolled
For iPhones purchased after 2018, the factory reset cryptographically erases the encryption key, making data recovery effectively impossible - so factory reset alone is sufficient.
E-Waste Disposal in Perth
IT equipment cannot legally be disposed of in general waste in Western Australia - it must be taken to an approved e-waste facility. Perth has a number of e-waste drop-off points and recycling services. Some managed IT providers handle e-waste disposal as part of a device refresh project - ask whether data destruction certification is included.
Secure wiping, MDM unenrolment, and e-waste disposal are all handled as part of our managed IT service plans.
Managed IT Services →The Privacy Act Obligation
Under the Privacy Act 1988, businesses must take reasonable steps to destroy or de-identify personal information that is no longer needed. Disposing of a device containing customer or staff personal information without proper data destruction could constitute a breach of this obligation. Keep disposal records as evidence that you have met this requirement.
Frequently Asked Questions
Does formatting a hard drive actually delete the data on it?
No. Formatting a drive just marks the space as available to be overwritten, it doesn't erase the actual data. Anyone with free, easily available recovery tools can pull files, passwords, and documents off a "formatted" drive, which is why proper wiping or destruction is needed before a device leaves your business.
Do SSDs need to be wiped differently to old-style hard drives?
Yes. Traditional overwrite tools that work well on spinning hard disks aren't reliable on SSDs and NVMe drives because of how they manage data internally. The safer approach for solid-state storage is the manufacturer's built-in secure erase function, or physical destruction if the drive is failing or holds particularly sensitive data.
Can I just put an old office computer in the bin or donate it as-is?
No, on both counts. IT equipment can't legally go into general waste in Western Australia, it needs to go through an approved e-waste facility, and donating or selling a device without properly wiping it first risks handing over client files, saved passwords, and business records to whoever ends up with it.
Do I need a certificate of destruction for old equipment?
It's not a strict legal requirement for every business, but it's good practice, especially for drives that held sensitive data like financial or client records. A certificate from a specialist e-waste or data destruction provider gives you a documented record that the device was properly dealt with, which is useful if you're ever asked to show how you met your data protection obligations.
Need help with a device refresh or secure disposal for your Perth business?
Call 0433 087 091 - we manage the full device lifecycle including secure wiping, MDM unenrolment, and responsible e-waste disposal.
Get in TouchFor related reading, see our guides to AI Usage Policy for Staff: Using ChatGPT and Copilot Safely and Windows 10 End of Support: A Checklist for Perth Businesses.