A laptop retired from your family department holds the same material as the files it was working on. Financial disclosure, medical reports, safeguarding notes, counsel's advice. The duty attached to that material does not lapse because the machine has.
Confidentiality has no end date
The SRA Standards and Regulations require you to keep your clients' affairs confidential. That duty runs on after the matter closes, after the retainer ends, and after the client has died. It makes no exception for the storage medium.
Privilege is stricter still, and it belongs to the client rather than to you. A drive sold on with data still readable is a disclosure you cannot take back, explained to the client, the insurer and the regulator at once.
Chambers face the same problem through a different door. A set is not a firm but self-employed barristers sharing premises and clerks, so a retired shared server carries the duty of every barrister whose papers touched it.
What your COLP can put in the file
Compliance officers are asked to evidence a decision, not describe it. You get documents that stand alone:
- A collection manifest listing every asset by make, model and serial number. Items are logged as they are loaded, we both sign the completed list before the van leaves, and you keep a copy.
- A Certificate of Data Erasure for every drive, referenced to the drive's own serial and to the parent asset serial on the manifest.
- A record of what happened to each item: refurbished and resold, recycled, or physically destroyed.
That is the file that answers a client's supply chain audit, and your COFA gets the other half, because resale value is credited back to the practice.
From desk to erasure
We collect from your office, so the chain of custody starts in your building, and whoever collects the equipment does the erasure. We never open, index or list what is on the drives. Nobody reads a client file, a matter reference or a filename, because nothing is ever mounted: the drive is sanitised before anything else is done to the machine.
Erasure follows NIST SP 800-88 Rev. 1, or HMG Infosec Standard 5 Enhanced where a panel requires it; the method is on certified data destruction. These are the standards we work to, not certifications we hold.
Retention runs in two directions
Your retention schedule is per matter, not per machine. Wills, deeds and probate papers may need holding indefinitely; conveyancing, personal injury and company files run to their own clocks, and one laptop can hold material from all three.
Settle that before the hardware leaves. Once we have a machine our job is to make its data unrecoverable, and we cannot tell which folder was still in its window. If you want a device held back, say so.
A skip is not a disposal route
Equipment dumped in a skip, or handed to a recycler who weighs it and moves on, leaves no record of what was on it. If it resurfaces, four things start at once:
- a personal data breach report to the ICO
- notification of the clients affected
- a call to your insurer
- your COLP deciding if it is material enough to report to the SRA
All of that from a laptop nobody wanted.
We collect across Oxfordshire, Buckinghamshire, Berkshire, Northamptonshire and Warwickshire, free where the resale value in the load covers it and quoted up front where it does not.
Tell us what you have: makes, rough quantity, and if the drives are still in the machines. Then get a quote. Questions to oliver@kiverefresh.com.