Guides → Practical guides

IT disposal for schools and academy trusts

25 September 2026 · 4 min read

Schools hold some of the most sensitive personal data of any organisation, much of it about children, and they have to dispose of equipment on tight budgets with a small IT team. The good news is that a simple, repeatable process covers almost everything.

Where the sensitive data actually is

It's natural to focus on the pupil devices, but they usually hold the least. The riskiest devices tend to be:

• Staff laptops, especially those used by safeguarding leads, SENCOs, pastoral staff and the office. They hold local copies of reports, notes and downloads.
• Office PCs that have been used with the management information system, finance and HR.
• On-site servers and network storage, including old ones that were decommissioned when the school moved to the cloud but never removed.
• Copiers, which keep images of everything they've scanned. See the hard drive in your printer.
• Loose USB sticks and external drives in drawers across the site.

Safeguarding records and information about special educational needs or health are the most sensitive categories a school holds. Health data is special category data under UK GDPR. Any device that has touched them needs certified destruction, not a best-effort wipe.

Chromebooks and tablets

Chromebooks are everywhere in schools, and they're handled differently from Windows laptops. Their storage is usually flash soldered to the board, so it can't be taken out, and it certainly can't be degaussed. ChromeOS encrypts user data by default, and the route for reuse is:

1. Deprovision each device in the Google Admin console. If you skip this, it can re-enrol into your domain and will show as licensed to you.
2. Powerwash it (the ChromeOS factory reset).
3. Record the serial against your asset register.

Devices that are broken, very old or past their automatic update expiry date, when Google stops sending updates, are best shredded. Shared iPads and Android tablets need releasing from your MDM and any Apple or Google enrolment programmes first. See activation locks and MDM.

Timing: plan around the summer

Most school refreshes happen over the summer holidays, which means most collection requests arrive in the same six weeks. Book collection dates in the spring term, not in the last week of July. Plan for the old kit to leave in the same holiday it's replaced, so it doesn't sit in a classroom cupboard until October.

Governance

School equipment is bought with public money, so disposals need a paper trail your governors or trustees can stand behind:

• A disposal policy approved by governors or trustees, covering authorisation, data security and value for money.
• An up-to-date asset register with disposed items closed off and referenced to a certificate. See building the register.
• Records of any value recovered through resale or buyback, which should be accounted for in the school's or trust's accounts.
• Evidence of due diligence on your disposal supplier: licences checked, a written agreement, and certificates reconciled.

Academy trusts should follow their own financial regulations and the Academy Trust Handbook when disposing of assets. Maintained schools should follow their local authority's scheme for financing schools. Your school business manager will know which applies.

"Can parents or a charity have the old laptops?"

It's a generous idea, and with the right controls it can work. Before any device goes to a family or a charity:

• It must be sanitised with certified software and a verification report, not simply reset.
• It must be removed from all school management and enrolment systems.
• Check the licensing of the operating system and software on it.
• Record the handover in writing, with the serial number.

If that isn't practical, a disposal company that refurbishes equipment can often route it to schools or charities through its own resale channels, with the data properly dealt with first.