Before the Lease Van Arrives: Wiping the Office Copier’s Memory

Most small offices have one. It sits near the kitchen, hums gently, jams on a Friday afternoon and quietly scans half the company’s paperwork. The multifunction printer, or MFP, feels like furniture. It is usually treated like furniture too. When the lease ends, someone rings the supplier, a van turns up, and the machine disappears.

That is the moment to pay attention. Modern copiers are small computers with paper trays attached. Many contain a hard drive, solid-state storage or embedded flash memory. They cache print jobs, store scanned documents, remember email addresses, keep fax memory and hold address books. In a small UK firm, that can mean signed contracts, payroll forms, client ID documents and internal memos sitting on a disk that nobody has thought about since installation.

The copier is a data device now

A basic desktop printer may have very little memory. A floor-standing MFP in a shared office is a different creature. It may run an operating system, support scan-to-email and scan-to-folder, keep a job history and allow users to store documents for later printing. Some models can hold thousands of pages of cached data.

That is useful during the lease. It is a liability at handback. Under UK GDPR and the Data Protection Act 2018, you are expected to handle personal data securely throughout its life, including when equipment is retired. You do not need a dedicated security team to do this properly. You do need a routine, a little patience and a few awkward questions for the lease company.

What might be living inside it

Start with the obvious. Scanned documents may be stored in a mailbox, a hold queue or a folder on the device. Print jobs may be cached. The address book may contain staff and client email addresses. Scan-to-email settings may include usernames and server details. If the machine has fax capability, fax memory can retain pages. Job logs can show who printed what and when.

Then there is the storage itself. Some devices use a standard hard drive that can be removed. Others use soldered storage or an encrypted drive with a crypto key. Some lease agreements include the drive as part of the machine. Others treat it as a separate asset. You need to know which one you have before the van arrives, not while the driver is waiting by the door.

Ask the lease company early

This is the bit people leave until the last week. Try not to. When the machine is due to go back, ask the supplier or lease company a short set of questions in writing:

• Does this model contain a hard drive, SSD or other non-volatile storage?
• Is the storage included in the lease, or is it our responsibility to remove and destroy it?
• Does the device support a built-in data sanitisation or crypto-erase function?
• Will you provide a certificate confirming the storage was wiped or removed?
• If we remove the drive ourselves, does that affect the return condition or any charges?
• What is your standard disposal route for returned machines?

A good supplier will have answers ready. A vague one is worth pushing. If the machine is going to a refurbisher or a waste site, you want a paper trail. A verbal assurance that it will be wiped is not the same as a certificate.

A simple wipe-or-remove checklist

Use this as a handback routine. It is not a substitute for the manufacturer’s instructions, but it keeps the job moving.

1. Find the exact model and check the manual for storage details. Look for terms like hard disk, SSD, eMMC, temporary storage or document box.
2. Ask the lease company or owner for written guidance before you start. If the machine is managed by an IT provider, involve them early.
3. Export anything you need to keep, such as the address book or scan destinations, then store it securely. Do not leave the export on a shared USB stick in the stationery cupboard.
4. Clear user data through the admin menu. That usually means address book entries, job history, stored documents, mailboxes, fax memory and any saved scan-to-folder credentials.
5. Run the built-in wipe or sanitisation function if the model has one. If it does not, ask about removing the drive.
6. If you remove the drive, label it, store it securely and arrange destruction through a proper IT asset disposal or WEEE route. Do not put it in the office wheelie bin.
7. Perform a factory reset after the data clear, then check that address books, job logs and stored documents are actually gone.
8. Record what you did. Note the model, serial number, asset tag, date, action taken and who did it. Keep any certificate with your asset records.

When a factory reset is not enough

A factory reset is better than nothing, but it is not always a data wipe. On some devices it returns settings to default while leaving stored documents or job history behind. On others it removes the encryption key, which can make the data unreadable, but only if encryption was enabled in the first place.

If the machine is old, the lease company is unclear, or the device has handled payroll or client records, removal and destruction is the safer route. A wiped drive with a certificate is good. A drive that has been physically destroyed by a reputable disposal firm is easier to explain if anyone ever asks.

The handback day

Do not let the machine leave before the paperwork is sorted. The driver is usually there to collect a box, not to discuss data sanitisation. Have your checklist signed off, keep a copy of any wipe certificate and make sure the asset register is updated. If the lease company is collecting the machine, note the serial number and the date it left the building.

It also helps to add the MFP to your joiners and leavers routine. When someone leaves, remove their scan-to-email address and any stored documents. When the lease is coming to an end, put a reminder in the calendar a month before. Small habits like that stop the copier becoming the forgotten member of the team.

The machine in the corner knows more than it lets on. Before the lease van arrives, make sure it does not take that knowledge with it.