Before It Leaves the Building: Retiring an Office Computer Without Creating a Data Problem

Most small offices have one: a cupboard, a shelf, or a corner behind the printer where retired laptops go to be forgotten. The machine is old, the screen is scratched, and nobody is quite sure whether it still works. So it stays. And because it stays, so does everything on its drive — client files, payroll spreadsheets, saved browser passwords, maybe a cached mailbox that nobody remembered to clear.

A locked cupboard is not a security control. It is a delay. When a computer finally leaves your building, it should leave with a paper trail, not a question mark.

The good news is that this does not need to be a project. For a typical small firm, a sensible retirement routine takes about 45 minutes per machine. Here is how to spend them.

First, find it on the asset register

Start with the boring bit: identity. Before you wipe anything, confirm what the machine is, who used it, and what it connects to. Check the asset tag, serial number, make and model. If it is not on your asset register, add it now — even if you are about to dispose of it. A register that only lists current equipment is half a register.

While you are there, note any licences tied to the device. A Windows OEM licence usually stays with the hardware. A Microsoft 365 licence is assigned to a person, not a PC, so it may need reassigning or removing from your tenant. Antivirus, remote-management agents, backup software and device-management profiles also need to be cleaned up. None of that is dramatic, but it is much easier to do while the machine is in front of you than six months later when somebody asks why you are still paying for a seat.

Decide what happens to the data before you touch the drive

This is the part people rush. Ask a simple question: is there anything on this machine that is not stored somewhere else? If the answer is “probably not”, prove it. Check the user’s profile, desktop, downloads, local shared folders and any line-of-business app that saved data locally. If there is something worth keeping, copy it to your approved storage and record that you did so.

Do not use the old PC as an informal archive. If the machine is being retired, the data should move to a managed location with backup and access controls. A folder on a dying hard drive is not a records-management strategy.

Wipe the drive to a documented standard

A factory reset is not the same as a documented wipe. For a small firm, the practical approach is to use a reputable sanitisation tool or your IT provider’s process, record the method, and keep the certificate. For encrypted drives, cryptographic erase can be appropriate where the tooling supports it. For older mechanical drives, overwriting may be needed. If a drive is failing, encrypted, or simply too sensitive to risk, remove it and have it physically destroyed rather than passed on.

What matters is that you can say what was done, to which serial-numbered drive, on what date, and by whom. “Dave wiped it” is not an audit trail. A one-page record with the asset tag, drive serial, tool and version, date, and certificate reference is enough for most small businesses.

Deal with the peripherals and the hangers-on

Docks, keyboards, mice, headsets and monitors are easy to overlook because they feel harmless. Usually they are. But they still carry asset tags, and some peripherals have paired Bluetooth or configuration data. Remove them from your asset list, check for cables and adapters that belong to something else, and decide whether they will be reused, donated or recycled. Do not let a box of anonymous power supplies become the next cupboard mystery.

If the machine was used for card payments, CCTV viewing, label printing or any other little side job, check whether it holds credentials or configuration for that service. A retired PC can still be a key to something else.

Choose a compliant WEEE route

In the UK, waste electrical and electronic equipment is covered by the WEEE Regulations. That does not mean you need a specialist consultant for every old desktop, but it does mean you should not put computers in the general waste bin or hand them to an unknown man with a van. Use a local household waste recycling centre that accepts electricals, a registered waste carrier, or a manufacturer take-back scheme. If a charity is taking the equipment, confirm they actually want it, that it has been wiped, and that you have agreed who is responsible for what.

Ask for a waste transfer note or receipt. Keep it with the wipe record. If anybody ever asks where the machine went, you want an answer that is shorter than a shrug.

The 45-minute version

Here is the routine in one place:

• 0–5 minutes: Find the asset record, serial number and user details. Add anything missing.
• 5–10 minutes: Check for local data, transfer anything needed, and record the transfer.
• 10–25 minutes: Wipe or remove the drive using your documented method. Capture the certificate or record.
• 25–30 minutes: Remove or reassign licences, agents and device-management entries.
• 30–35 minutes: Sort peripherals, cables and asset tags.
• 35–40 minutes: Book the WEEE route and get the paperwork.
• 40–45 minutes: File the record: asset tag, serial, wipe method, certificate, destination and sign-off.

That is it. No ceremonial send-off required.

The point is not to turn a cupboard clear-out into a compliance epic. The point is to make sure a forgotten hard drive does not become a data breach, and that the machine leaves your building with a clean story. For a small UK firm, that is a very good use of three quarters of an hour.