Nearly every business we visit has the cupboard. A shelf, a drawer or a box under a desk with a few years of retired laptops and phones on it, kept because throwing away a computer felt wrong and dealing with it properly never reached the top of the list. On a recent visit it was nine devices. None had been wiped, none had a certificate to say so, and every one still held live data from the day it was set aside.

The reason this matters is that switching a laptop off does not empty it. The files, the saved logins, the emails and whatever customer or patient data was on it are all still there, readable by anyone who powers it up or pulls the drive. A device that leaves your control still full of data is a breach waiting to be discovered, and the fact that it was “just sitting in the cupboard” is no defence if it walks out during a break-in or an office move.

The word that matters here is certificate. When you dispose of or recycle a device properly, a reputable service either securely wipes it or physically destroys the drive and gives you written evidence that they did. That certificate is what turns “we think it was probably fine” into “we can prove that data no longer exists”, which is exactly the difference an assessor, an insurer or the ICO will ask about after the fact.

So deal with the cupboard as a small project, not a someday. List what is in there, note what data each device likely held, then either wipe them yourself with proper software and keep the record, or use a certified disposal service and keep their certificates. Until that is done the devices are still your responsibility, and the longer they sit, the easier it is to forget what was ever on them.