ReCore IT is committed to the secure and verifiable destruction of data on all IT equipment we collect. Every client receives a signed destruction certificate detailing exactly what was done and when.
ReCore IT is registered with the Environment Agency as an upper tier waste carrier, broker and dealer under registration reference CBDU648147.
Purpose
This policy sets out the standards, methods, and procedures ReCore IT follows when handling data-bearing devices collected from businesses. It is intended to give clients the confidence that their obligations under UK GDPR and ICO guidance are met when they use our service.
Scope
This policy applies to all data-bearing devices collected by ReCore IT, including but not limited to:
- Laptops and desktop computers
- Hard disk drives (HDDs)
- Solid state drives (SSDs)
- USB drives and removable storage media
- Servers and networking equipment with onboard storage
Standards we operate to
All data destruction carried out by ReCore IT follows recognised industry and government standards:
NIST SP 800-88 (Guidelines for Media Sanitisation)
The primary standard used by UK government and public sector organisations for data sanitisation. We follow the Clear, Purge, and Destroy guidelines as appropriate for each media type.
ICO guidance on data destruction
Our processes are aligned with the Information Commissioner's Office guidance on the secure disposal of personal data under UK GDPR.
Data destruction methods
Hard disk drives (HDDs)
HDDs are overwritten using DBAN (Darik's Boot and Nuke) or equivalent software, performing a minimum of one full overwrite pass. Where a device is beyond repair or overwriting is not possible, the drive is physically destroyed by drilling through the platters to render data irrecoverable.
Solid state drives (SSDs)
SSDs are sanitised using the manufacturer's Secure Erase command or equivalent tooling, as standard overwrite methods are not fully effective on flash-based storage. Where Secure Erase is not available or the drive is faulty, the drive is physically destroyed.
Physical destruction
Where physical destruction is required or requested, drives are rendered permanently unreadable. Destroyed media is photographed before disposal, and the method and outcome are recorded on the destruction certificate.
Our process
- Collection and logging
All devices are logged at the point of collection. We record the device type, make, model, and serial number where visible.
- Assessment
Each device is assessed to determine whether it is suitable for software-based sanitisation or whether physical destruction is required.
- Data destruction
The appropriate destruction method is applied in line with this policy. All destruction is documented, including the method used and the date completed.
- Certificate issued
A signed destruction certificate is issued to the client, listing each device by serial number, the destruction method applied, and the date of destruction.
- Disposal or refurbishment
Once data has been securely destroyed, devices are either refurbished for resale or broken down for responsible recycling. Nothing is sent to landfill.
Destruction certificates
Every client receives a written destruction certificate following their collection. This certificate includes:
- Client name and organisation
- Date of collection and date of destruction
- A list of each device processed, including type and serial number
- The destruction method applied to each device
- A signed declaration from ReCore IT confirming destruction
We recommend retaining this certificate as part of your data processing records. It provides evidence of compliant disposal in the event of an ICO audit or data breach investigation.
Record keeping
ReCore IT retains records of all destruction activities for a minimum of 6 years. These records are held securely and are available to clients on request during this period.
Client responsibilities
Clients are responsible for ensuring that all data-bearing devices intended for destruction are included in the collection. ReCore IT cannot accept responsibility for data on devices that were not handed over as part of the agreed collection.
Clients should inform us prior to collection if any devices contain particularly sensitive data (such as special category personal data under UK GDPR) so we can ensure the most appropriate destruction method is applied.
Questions about this policy
If you have any questions about our data destruction process or would like to discuss specific requirements before booking a collection, please get in touch:
- Email: hello@recoreit.co.uk
- Phone: 07808 303976