Data is nowadays the most valuable asset of any organization. But once hardware is replaced, that data becomes a serious risk. Many companies have their cybersecurity in place on the front end, but fall short when it comes to disposing of their equipment. The General Data Protection Regulation (GDPR) is clear: you must be able to prove that personal data has been permanently and securely deleted at the end of the journey. But how do you ensure that process when you hand over the hardware?
In this article, we dive into the world of the General Data Protection Regulation (GDPR). We explain how to remain GDPR-compliant when disposing of hardware and where the boundary lies between your responsibility and that of W3E.
What is the GDPR and why is it important?
Let’s start at the beginning: what does GDPR stand for? GDPR stands for the General Data Protection Regulation. This is a European directive that sets out how we handle personal information. Since the introduction of this GDPR legislation, the rules surrounding data protection have become much stricter.
When does the GDPR apply? Basically, whenever you process data from individuals. Think of customer data, personnel files, or even marketing lists. All this information is stored on the hard drives of your old equipment.
Your role as the ‘data controller’
According to the GDPR rules, as the owner of the hardware, you remain the ‘data controller’. This means that you must be able to prove that you are doing everything possible to prevent an GDPR data breach.
An important part of this is data minimization: do not collect more data than necessary and do not store it for longer than necessary. This also includes the question: how long should you keep personal data? The law does not set a hard deadline, but does stipulate a retention period for personal data that is linked to the purpose. Has the hardware been decommissioned? Then the purpose has expired and the data must be irreversibly destroyed.
Recognizing special and sensitive data
Not all data is equal. The Dutch Data Protection Authority makes a clear distinction:
- ‘Ordinary’ personal data such as name, address and email address.
- ‘Special’ personal data. What are special personal data? These are data about, for example, race, religion, health or political preferences.
- Criminal law data: relates to criminal convictions and criminal offenses, but also the security measures associated with them.
In addition, there are sensitive personal data that do not fall under the special categories of personal data under the GDPR. But if they are lying around on the street, they can have a significant impact on privacy. Examples include financial data and the citizen service number (BSN).
Does your organization fall into these categories? Then an certified data destruction not only desirable, but simply mandatory under the GDPR law.
W3E as a ‘processor’
As soon as we collect your hardware IT recycling, We act as the ‘processor’. We take on the physical responsibility of protecting your personal data. We document this in a processing agreement.
From the moment your equipment is loaded into our transport vehicles, we take care of a safe transport to our processing center. This minimizes the risk of an GDPR data breach during the logistical process.
How we help you stay AVG proof:
At W3E, we ensure that you fully comply with the requirements of the GDPR:
- Software-based data destruction: With Blancco software, we erase data irreversibly.
- Physical destruction: Defective discs go directly into the shredder.
- Certification: After the processing, you will receive an extensive report and associated destruction certificates. This is your proof of compliance with the Personal Data Authority.
- WEEELABEX certified: We operate in accordance with the strictest European standards.
Please note: a data breach under the GDPR can lead to heavy fines and damage to your reputation. According to the law, simply formatting a disk is not sufficient. Therefore, we recommend that you always use a certified form of erase hard drives to choose.
The benefits of professional data destruction:
- Compliance with all GDPR regulations and legislation
- Preventing fines by the Personal Data Authority
- Certainty regarding the deletion of personal data
- A watertight administration with destruction certificates
Safety above all
We take full responsibility for your data. We assure you that all GDPR obligations are met until the very last bit is destroyed. This way, you can say goodbye to your old hardware with peace of mind, knowing that your customer data and sensitive personal information will never fall into the wrong hands. Contact us for a free consultation or a customized quote.
English 
Dutch