Compliance

It is important to consider compliance through each stage of the reusing IT for Good process, whether you are undertaking processes in-house or with a partner. Think about what your end-to-end will look like, making sure you consider every step in the process. For example, will you need to securely store the devices? Do you have a secure area where you can limit who has access? How will you ensure secure data wiping and refurbishment processes?

Data wiping

Our research has shown that one of the biggest challenges is overcoming risk aversion in data and information security. If you decide to outsource the work of data wiping and refurbishment, this risk is transferred and will provide reassurance that your organisation is compliant and your reputation will be preserved. Make sure your partner has the necessary accreditations and software to undertake data wiping securely [link to partnerships page].

Wiping or replacing hard drives can be done in-house but you must ensure that you are compliant with government guidance: 

• UK General Data Protection Regulation (GDPR) – Article 28
• Data Protection Act 2018
• Data (Use and Access) Act 2025 

Products for undertaking the data wiping process can be free of charge, or may incur a cost. You should make sure that any such product meets the suitable standards, such as:

• NIST standards: 800-88 Standard for Media Sanitisation
• IEEE 2883-2022 – Standard for sanitising storage

ADISA undertake assessment of products suitable for data wiping, you can find a list of compliant products under ‘product certification/product assurance’.

Refurbishment

We recommend that you partner with an expert organisation to carry out refurbishment of devices. When selecting a partner, ensure that they comply with: 

• Electrical Equipment (Safety) Regulations, 2016
• Reusing waste electrical and electronic equipment (WEEE) and components removed from WEEE (2022)
• The T11 exemption – this allows an organisation to repair, refurbish or dismantle various types of WEEE so that the whole WEEE item or any parts can be reused for their original purpose or recovered.

Disposal

If you have any devices that, after assessment, are unsuitable for reuse and must be disposed of, you are most likely to engage a waste management organisation for this. Ensure that they comply with:

• Waste Electrical and Electronic Equipment (WEEE)