Secure Data Disposal: Before You Donate or Recycle PCs

That Old Computer in the Closet Is a Data Risk

Most small offices have them: a stack of retired laptops under a desk, a dusty tower in the storage room, a box of old hard drives nobody wants to touch. When it's finally time to clear them out, the instinct is to drop them at a recycling event, hand them to a staff member, or donate them to a good cause.

Here's the catch: unless you properly erase them first, those machines may still hold customer records, employee Social Security numbers, financial data, saved passwords, and years of email. Deleting files or dragging them to the trash does not actually remove the data — it just hides it. Anyone with free recovery software can bring it back.

For a Massachusetts business, this isn't just embarrassing — it's a legal issue. The state's data protection law (201 CMR 17.00) requires businesses to protect personal information about Massachusetts residents, and that duty doesn't end when a computer leaves your building. This guide walks you through doing it right.

Why "Delete" and "Format" Aren't Enough

When you delete a file, the computer simply marks that space as available for reuse. The actual data stays on the drive until something writes over it. Even reformatting (erasing and resetting) a drive often leaves recoverable traces.

To truly get rid of data, you need to either:

• Wipe the drive — overwrite it so the old data can't be recovered, or
• Destroy the drive physically so it can never be read again.

Which one you choose depends on whether the computer will be reused or scrapped. We'll cover both.

Step 1: Inventory What You're Getting Rid Of

Before anything leaves the building, make a simple list. For each device, note:

• The type (laptop, desktop, server, external drive, old phone)
• A serial number or asset tag if it has one
• Who last used it and what kind of data it likely held
• What you plan to do with it (donate, sell, recycle)

This list becomes your paper trail. If a client or auditor ever asks how you handled their data, you can show exactly what happened to each machine.

Don't forget the less obvious devices: multifunction printers and copiers often have internal hard drives that store scanned documents. Old smartphones, tablets, and USB backup drives count too.

Step 2: Back Up Anything You Still Need

Once a drive is wiped, it's gone for good. Before you erase anything, make sure you've saved:

• Files, spreadsheets, and documents still in use
• Software license keys and installation files
• Email data, if it was stored locally rather than in the cloud
• Any specialized or industry software settings

Move this to your current computers, a server, or your cloud storage (Microsoft 365, Google Workspace, etc.). Confirm the backup actually opens and works before you wipe the old machine.

Step 3: Sign Out and Unlink Accounts

Modern computers are tied to accounts and licenses. Skipping this step can lock you out of software you've paid for or leave accounts active on a device you no longer control.

On each machine, be sure to:

• Sign out of Microsoft 365, Google, and any browser profiles
• Deactivate software licensed to that specific device (some design, accounting, and creative apps limit how many machines they run on)
• Turn off "Find My" or device-tracking features on Apple and Windows devices
• Remove the device from your management tools or mobile device management, if you use them

Step 4: Wipe or Destroy the Drive

Now the critical part. Your approach depends on where the device is headed.

If the computer will be reused (donated or sold)

You want the machine to still work, but with all data gone. Options include:

• Built-in reset tools. Windows has a "Reset this PC" option with a "Remove everything" setting that includes data cleaning. Macs can be erased through Disk Utility or the built-in erase-all-content feature. These are reasonable for most everyday office computers.
• Dedicated wiping software. For machines that held sensitive data, purpose-built erasure tools overwrite the entire drive and produce a certificate confirming it was done.

A note on drive types: most newer computers use SSDs (solid-state drives, which have no moving parts), and these need to be erased differently than older spinning hard drives. The right tool matters, which is one reason many businesses hand this step to an IT provider.

If the computer is being scrapped

If a machine is dead or too old to reuse, the simplest sure thing is to physically destroy the drive so no data survives. The gold standard is professional shredding — specialized equipment that grinds a drive into pieces. Many certified electronics recyclers offer this and give you a destruction certificate.

Step 5: Choose a Responsible Recycler

Electronics contain materials you can't legally toss in the regular trash in Massachusetts, and you want proof your data was handled correctly. Look for a recycler that:

• Is certified (industry standards like R2 or e-Stewards signal responsible handling)
• Provides a certificate of data destruction listing the devices they processed
• Can document that materials are recycled responsibly, not dumped overseas

Many South Shore towns — Braintree, Quincy, Weymouth and others — run periodic electronics recycling drop-off days, which are fine for a dead monitor. But for anything that stored business data, use a certified vendor who documents destruction.

Step 6: Keep the Paperwork

File your inventory list alongside any wipe or destruction certificates. Keep it with your other compliance records. If you're ever asked to prove you disposed of data responsibly, this is what protects you.

A Quick Checklist

• [ ] Inventory every device, including printers and USB drives
• [ ] Back up and verify anything you still need
• [ ] Sign out of accounts and deactivate licenses
• [ ] Wipe reusable machines; destroy drives being scrapped
• [ ] Use a certified recycler with destruction certificates
• [ ] Save all documentation

The Bottom Line

Donating or recycling old computers is a great move — for your budget, a local nonprofit, or the environment. Just don't let data walk out the door with the hardware. The whole process comes down to three things: save what you need, destroy what you're leaving behind, and keep proof you did it.

If your business is clearing out a pile of aging equipment and you'd rather not guess which drives are safe to reset versus shred, a managed IT provider can handle the wipes, line up certified destruction, and give you the paperwork. If you're a small or mid-sized business on the South Shore and want a second set of eyes, you're welcome to book a free 20-minute IT Fit Call with Elecrics at https://elecrics.com/book. No pressure — just straight answers.