GDPR and Redundant IT equipment - What do the companies need to provide?

[maxrebo]

We have a company who collect our old IT equipment including HDD`s, with the upcoming GDPR, Is there any documentation I need to collect from them prior to their visit with regards to GDPR? i.e Data protection policy etc..

[hallb15]

I would have thought it will remain the same, or very similar as the current guidelines from the ICO.

https://ico.org.uk/media/for-organisations/documents/1570/it_asset_disposal_for_organisations.pdf

 

More specifically

 ensure you delete personal data before recycling devices, so that data is not accessible to others after the device has left your ownership; 

be aware that any specialist service provider you use will be considered to be a ‘data processor’ under the DPA; and

 have a written contract in place between you and the data processor, ensuring that there is an appropriate level of security in place.

 

and

 

The DPA sets out that a written contract must be in place between your organisation and the data processor, so that both parties are aware of their obligations. Ensure that your contract includes:

• explicit direction on the services to be undertaken and that it may only act in accordance with your instructions;

• an approved specification for IT asset disposal which is aligned to your disposal/security policy; and

• full details of all downstream partners involved in the service. Any downstream partner contracts should include the same data controller specification for IT asset disposal as the minimum service level to be met.

[enjay]

We have a company who collect our old IT equipment including HDD`s, with the upcoming GDPR, Is there any documentation I need to collect from them prior to their visit with regards to GDPR? i.e Data protection policy etc..

 

Nothing you shouldn't have already been collected under Data Protection Act 1998. ISO9001, 14001, 27001 EN15713 and ADISA are all in the email footer of the company we use.