Get in touch with
Extech.
Have a question about recycling or data destruction, or an idea for how we can improve? Share your requirements or suggestions, and a specialist will review them and get back to you shortly.
Data security when you retire IT equipment
Retired laptops, servers and phones are where business data leaks quietly. Use this page to find the gaps in your process, then close them with records you can show.
Four moments when retired data is exposed
Data does not leak because a device is switched off. It leaks when no one is accountable for it: in a cupboard, in a van, on a bench, or in a missing file.
-
Before pickup
- What can go wrong
- Retired devices sit in cupboards and storage rooms, where they can be taken, lost or simply forgotten.
- What reduces it
- A locked room, an asset list, and a collection booked soon after the refresh.
-
In transit
- What can go wrong
- Equipment leaves your control, and an unrecorded handover is hard to reconstruct later.
- What reduces it
- A manifest with time-stamped photos at pickup, and tracked logistics with custody recorded from your door to our facility.
-
At the facility
- What can go wrong
- Devices are handled by people and processes you cannot see.
- What reduces it
- Assets are audited and logged on arrival, and every storage device is erased with NATO-certified software or shredded.
-
After the job
- What can go wrong
- Without records, you cannot show an auditor, a client or the Privacy Commissioner that the data was destroyed.
- What reduces it
- Erasure certificates for each erased device, serialised certificates of destruction for shredded media, and portal access to your records.
How ready is your device retirement?
Tick every statement you could prove to an auditor today. Nothing is stored or sent: the result stays on your screen.
0 of 8 ticked
Tick what you can prove to see where the gaps are.
Still to close
A general good-practice check, not an audit.
What NZ law expects when you retire IT
The Privacy Act 2020, in force since 1 December 2020, applies to retired devices as much as live ones. These are the parts that matter, and the evidence worth keeping for each.
Security safeguards (principle 5)
Personal information must be protected against loss, misuse and unauthorised access. That includes the devices that hold it after you stop using them.
Keep as evidence
Your retirement process, and records that it was followed.
No longer than necessary (principle 9)
Do not hold personal information for longer than you need it. A retired laptop in a cupboard is still holding it.
Keep as evidence
A dated record of when each device was erased or destroyed.
Breach notification
If a breach is likely to cause serious harm, you must tell the Privacy Commissioner and the people affected. Failing to notify the Commissioner is an offence, with a fine of up to $10,000.
Keep as evidence
Records showing whether the data was destroyed, which help you judge whether a loss is notifiable.
General information only, not legal advice. Last reviewed October 2026. Health agencies also work under the Health Information Privacy Code 2020. Sources: Community Law and the Office of the Privacy Commissioner. Check current requirements with your legal adviser.
Data security: your questions
The questions security and compliance teams ask most. Not covered here? Ask us.
Is encrypting a drive enough before disposal?
Encryption lowers the risk, but it depends on key management and the strength of the encryption, and many policies still require erasure or destruction when a device is retired. Treat encryption as an extra layer, not a replacement.
Can data be recovered after erasure?
Certified erasure software overwrites the data and is designed to make it unrecoverable. Media that has failed, or cannot be reliably erased, is shredded instead. Ask us which method suits your risk.
What about phones and tablets?
Clear the device from management and release any activation lock or cloud account before pickup. Smartphones can then be erased with supported software if they are to be reused, or shredded to 20mm fragments.
What about SSDs?
SSDs can be erased with supported software or shredded. The right choice depends on whether you want to reuse the device and how sensitive the data is, so we recommend a method per device type.
Who is responsible if a supplier loses a device?
Under the Privacy Act 2020, using a supplier does not move your responsibility for the personal information on the device. That is why records of custody and destruction matter. This is general information, not legal advice.
How long should we keep disposal records?
As long as your audit, contractual and retention rules require. Keep the manifest and certificates filed with your asset register, and check your own policy or legal adviser for the period.
We work under sector rules. Can you meet them?
The right method and records depend on your rules. Tell us your requirements, and we will recommend a method and confirm which records we can provide.
Close the gaps
Each of these goes deeper on one part of the picture. Or talk to us about your own clear-out.