IT disposal for schools, GP surgeries and clinics: what to get right

Updated 6 November 2026 · By the IT Equipment Disposal team

Short answer: Schools and healthcare providers hold some of the most sensitive personal data there is, so IT disposal should combine certified erasure or shredding for every device, a per-device report, a registered waste carrier and a written agreement with the provider. Healthcare organisations should follow NHS and NCSC guidance on sanitisation, and schools should involve their data protection officer and keep records with their asset register.

Why these sectors need extra care

Pupil records, safeguarding notes, special educational needs information, patient records and test results are all special category or highly sensitive personal data. A single disposed laptop or practice server with that data still on it could lead to a serious breach, a report to the ICO within 72 hours where required and significant reputational damage.

Both sectors also have devices in places that are easy to forget: classroom laptop trolleys, staff room PCs, reception desk computers, dictation devices, clinical equipment with built-in storage and multifunction printers that have scanned years of letters.

They also tend to have complicated ownership. A school might hold devices it bought, devices leased through a finance scheme, devices supplied by the local authority and devices loaned under government schemes. A practice may have equipment owned by the partners, by the commissioning body and by a supplier. Work out who owns each group before arranging disposal, because the owner decides what happens to it.

Roles and responsibilities

The school, trust or practice is the data controller and remains responsible for the data until it is destroyed
The data protection officer should be involved in agreeing the disposal method and evidence required
The IT provider or managed service often prepares devices and holds the asset register
The disposal company acts as a processor and should work under a written agreement
The business manager or practice manager usually signs off the paperwork

Choosing the right method by device

Device	Common approach
Pupil or staff laptops and desktops	Certified erasure, then reuse or donation
Chromebooks	Deprovision from the Google Admin console, then powerwash and reuse or recycle
Practice or school servers	Drives removed and shredded, chassis recycled or resold
Faulty or dead drives	Shredding with serial number recorded
Multifunction printers	Internal storage erased or removed and shredded
Phones and tablets	Release from management, certified mobile erasure or shredding
Clinical devices with storage	Check with the manufacturer and agree sanitisation before disposal

Healthcare specifics

NHS organisations and GP practices should follow the data security and protection requirements that apply to them, including NHS guidance on data sanitisation, which aligns with NCSC advice. Practices often use IT through a commissioning or support unit, so check who owns each device and who is responsible for disposing of it before arranging collection. Leased or centrally provided equipment may have its own return process.

School specifics

Academies and trusts with several schools benefit from a single disposal arrangement covering all sites, with separate paperwork per school. Summer holidays are the usual window for refreshes, so book collections early. Where devices are passed to pupils or families, erase and record each one first, and agree with families in writing that the device is theirs to keep and dispose of later.

Check your funding conditions too. Equipment bought with specific grants may have conditions on disposal, resale or how any proceeds are used.

Multi-academy trusts can also standardise the whole process across schools: one disposal policy, one method for each device type, one provider and one format of report. That makes it much easier for the trust's DPO to show consistent handling, and it avoids each school negotiating separately with different collectors.

Planning the timing

Timing matters more in these sectors than most. Schools have one realistic window, the summer holidays, when classrooms are empty and devices can be swapped without disrupting teaching, so collections across the country cluster in late July and August. Booking in spring gives you a choice of dates and time to prepare devices properly.

GP surgeries, dental practices and clinics rarely close, so collections are often arranged for early mornings, evenings or Saturdays, when patients are not in the building. Equipment should be gathered in a locked room beforehand, never in a corridor or waiting area where patients could reach it. Where drives must not leave the premises intact, on-site shredding can be scheduled for the same visit.

Book school collections for the summer holidays in the spring term
Arrange practice collections outside clinic hours
Store retired equipment in a locked room until collection
Prepare devices and release them from management a week ahead
Have the DPO or practice manager available to sign off on the day

Paperwork to keep

Collection manifest signed on the day
Waste transfer note, plus consignment notes for hazardous items
Per-device erasure reports and certificates of destruction
Final asset report reconciled with your asset register
Written agreement or contract with the disposal provider
Note of the DPO's approval of the method

Keep these together in your data protection records. If a parent, patient or regulator ever asks what happened to a device, you will be able to answer quickly and with evidence.