GDPR and IT Asset Disposal: What US Companies Need to Know
Does a company in California really need to worry about a European privacy law? If you’ve ever sold to a customer in Germany, run a website that tracks visitors from France or kept HR records for a team member in Ireland, the answer might be yes. And one of the places companies most often forget about GDPR is the very end of the line, when old servers, laptops and drives head out the door.
Here’s what GDPR is, why it reaches US businesses and what it expects from you when you retire IT equipment.
Quick answer: what is GDPR?
The General Data Protection Regulation, or GDPR, is the European Union’s data privacy law. It took effect on May 25, 2018, and it controls how organizations collect, use, store and get rid of personal data about people in the EU. That includes names, email addresses, IP addresses, account numbers, photos and pretty much anything else that can identify a person. You can read the full regulation on EUR-Lex if you’ve got a free afternoon and a large coffee.
Why GDPR can apply to a US company
GDPR doesn’t care where your headquarters are. Under Article 3, it applies to companies outside the EU if they offer goods or services to people in the EU or monitor their behavior, like through website analytics or ad tracking. If that’s you, GDPR applies to the personal data you hold about those people, wherever that data happens to live.
That includes the old file server in your back room, the backup tapes in a cabinet and the laptop a sales rep used for three years.
Why retired hardware is a GDPR problem
Personal data doesn’t disappear when equipment is unplugged. It sits right there on the drives until somebody properly erases or destroys it. GDPR’s core principles in Article 5 say you should only keep personal data as long as you need it and that you must protect it with appropriate security the whole time. A retired drive that still holds customer records checks neither box.
Then there’s the right to erasure in Article 17. When someone asks you to delete their data and you agree, that deletion is supposed to be real. If a copy is still sitting on a decommissioned server that’s headed to resale, you’ve got a gap.
Not so fun fact: if a drive with personal data on it goes missing during disposal, that can count as a personal data breach. Under Article 33, you generally have 72 hours to notify your supervisory authority once you’re aware of it. Fines for the most serious violations can reach 20 million euros or 4% of worldwide annual revenue, whichever is higher.
Your ITAD vendor is part of the picture
When you hand equipment to an ITAD company, they’re handling your data on your behalf. In GDPR terms, that usually makes them a processor, and Article 28 says you need a written agreement with a processor that covers how they’ll protect and handle that data. You’re also expected to choose vendors that can actually show they do what they say.
That’s why chain of custody matters so much. You want a record of every asset from the moment it leaves your rack to the moment it’s wiped, destroyed or recycled, with serial numbers attached. DES tracks each asset through our chain of custody process so there’s never a question about where a drive went.
What GDPR-ready disposal looks like
It starts before anything is unplugged. Know which systems hold EU personal data, and make sure anything you’re legally required to keep has been backed up or moved. Then inventory every asset by serial number, including loose drives, tapes and the drives inside printers and copiers that people tend to forget.
Next comes the actual sanitization. For drives that will be reused or resold, that means certified data erasure aligned with recognized standards like NIST SP 800-88, verified and logged by serial number. For drives that are failed, damaged or too sensitive to reuse, physical data destruction like shredding is the safer call. Our post on why secure data sanitization is critical for HIPAA and GDPR compliance goes deeper on choosing between the two.
Finally, get the paperwork. A certificate of destruction that lists each serial number, the method used and the date is the evidence you’ll want if a regulator, auditor or customer ever asks.
Questions to ask your ITAD partner
Ask whether they’ll sign a data processing agreement. Ask how they track assets from pickup to final disposition, and whether you’ll get serial-level reporting. Ask what erasure method they use and how they verify it. Ask who handles your equipment if they use subcontractors downstream. And ask what happens to drives that fail erasure. If an ITAD vendor gets vague on any of those, that tells you something. Our guide on how to choose an ITAD vendor has the full list.
Working across borders
If your equipment is spread across offices in multiple countries, it’s a no brainer to use one partner with one process instead of a patchwork of local recyclers. DES supports international ITAD with the same chain of custody and documentation no matter where the gear sits.
Retiring equipment that might hold EU personal data? Talk to DES about a disposal plan that holds up to scrutiny. And if some of that hardware still has resale value, our buyback brand will buy your used hard drives after they’ve been wiped.
Frequently Asked Questions
What is GDPR?
GDPR is the European Union’s General Data Protection Regulation. It took effect May 25, 2018, and it governs how organizations collect, use, store and dispose of personal data about people in the EU.
Does GDPR apply to US companies?
It can. Under Article 3, GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behavior, such as through website tracking.
Does GDPR require data destruction when hardware is retired?
GDPR requires that personal data is kept only as long as needed and protected with appropriate security. When hardware is retired, that means personal data on drives should be securely erased or destroyed, with records to show it was done.
Is an ITAD company a data processor under GDPR?
Usually, yes. An ITAD company that handles your devices and the data on them is typically acting as a processor, so GDPR Article 28 calls for a written agreement covering how it protects that data.