Disposal and reuse of computers
To comply with the Data Protection Act all data on hard disk drives must be identified and
erased before PCs and lap tops are disposed of or reused. This will ensure the security of the
University’s confidential information and personal data.
When disposing of old computers, it is also important to identify and erase all software on hard
disk drives to ensure that the University complies with its Software Licence Agreements.
Before wiping a hard drive consider how long the data on it should be retained by consulting the
University’s records retention schedule1 and the Records Management guidance on How to
manage research records2. You may need to transfer some of the data to a different location
before commencing the wipe.
Use the Boot and Nuke program by Darik which is available as freeware online at
http://dban.sourceforge.net to wipe them. This software is an appropriate utility for bulk or
emergency data destruction. Visually determine how many drives are installed in the computer.
This will highlight drives which may have become physically disconnected or damaged such
that they are not recognised by the software. As an additional precaution check the CDROM
and floppy disk drives for media inadvertently left in them.
Once you use the Boot and Nuke program everything on the computer will be destroyed. If you
are disposing of the computer attach a signed confirmation note to the hard drive, to show that
the hard drive has been wiped, before it is removed from the University site. Fill in a
confirmation note3 (available to download from the records management webpages), print it out
and attach it to the equipment.
If Boot and Nuke cannot be made to run or fails to run correctly, the hard drive must be
removed and an attempt made to erase it in a different computer. In cases where the hard drive
itself is faulty, contact INSRV Connect (ext. 74487, email, InsrvConnect@cardiff.ac.uk) who will
arrange for it to be looked at.
The EC Directive on Waste Electrical and Electronic Equipment requires the University to reuse
and recycle its computer electronic equipment. Once wiped, contact the University’s external
contractor4 who will, check it again to ensure that there is no data remaining, and where
possible sell on the hardware. The School or Division who sends in equipment will receive a
percentage of profits made on certain types of equipment sold. If the hardware is unsellable the
contractor will recycle as much of it as possible. Hardware which leaves the University’s
jurisdiction should be noted in the relevant School/Division inventories.
Destroying records on other media
Records you wish to destroy can also be on CD-ROM, audio tape, magnetic tape, floppy disk,
video tape, etc. If the information stored on these formats is personal, confidential or sensitive,
it is not enough to throw the disks or tapes away or try to break them before disposal. Such
materials should be sent via Manual Handling (ext. 74320, email, handling@cardiff.ac.uk) to the
Records Manager for confidential destruction (records@cardiff.ac.uk).
Governance & Compliance Division
4th Floor
McKenzie House
30-36 Newport Road
Cardiff
CF24 0DE
1
http://www.cf.ac.uk/govrn/cocom/recordsmanagement/recordsretention/recordreten.html
2http://www.cardiff.ac.uk/govrn/cocom/recordsmanagement/guidanceleaflets/index.html
3http://www.cf.ac.uk/govrn/cocom/recordsmanagement/guidanceleaflets/index.html
4
http://www.cardiff.ac.uk/osheu/resources/weee.doc