A law firm cannot explain away what is on its hard drives. Privileged client matter, conveyancing files, wills and case papers sit on the same laptops and desktops that reach the end of their working life on an ordinary refresh cycle, and the obligation does not stop when a machine is switched off. What the information governance file has to show is where each machine went and what happened to what was on it.

This firm runs about 120 staff, 70 of them fee earners, from a Cardiff office and one satellite. It was moving fee earners from desktops to laptops and replacing its server hardware in the same programme, which took roughly 310 assets out of service over a few weeks. Surplex UK Limited provides IT disposal for solicitors and law firms and IT disposal in Cardiff.

The Challenge: Matter Data on an Ordinary Refresh

Two conditions shaped the work. Nothing holding matter data could leave either building without a record good enough to put in front of an auditor. And the collection could not take fee earners away from their desks during working hours.

The Surplex Solution: On-Site Destruction, Out of Hours

The drives from the four servers and the two NAS units were shredded at the firm’s own office using the mobile unit, with the firm’s IT manager present throughout. Those drives held the matter data the firm was least willing to see travel, and shredding them on site meant the data never left the building. The desktop and laptop estate was collected under GPS-tracked transport and processed at the Gloucester processing centre.

  • 1. Everything Recorded Before It Moved

    Every device was recorded against its serial number at the point of collection, on site, before anything left the building. Collection and technical staff are screened to BS 7858, the British standard for vetting people who work in secure environments.

  • 2. Server Drives Destroyed On Site

    Destruction was carried out to BS EN 15713:2023, the Destroy method defined by NIST 800-88, with the firm’s IT manager witnessing it. Where value was recovered from hardware, the data was erased with Certus certified software instead, which is the Purge method under the same standard.

  • 3. Two Visits, Both Out of Hours

    The work was done in two visits three weeks apart, both outside office hours, timed so each group of machines was collected once its replacement was in place. No fee earner lost desk time to it.

  • Sector

    Legal

  • Location

    Cardiff and one satellite office

  • Assets

    310 units, 176 of them data-bearing

  • Key Win

    Server drives shredded on site and witnessed, collection free

"Our IT manager watched the server drives go through the shredder. That’s the answer I wanted when the auditor asked where the matter data went."

IT Manager, Cardiff law firm

The Results: A File an Auditor Can Read

The documentation was built to be filed rather than read once. Information governance obligations get audited, and an auditor asks what happened to one specific machine, not what happened in general. Of the 310 assets, 176 held data, and the reporting separates those from the monitors and peripherals that do not.

Metric
Outcome
  • Data-Bearing Devices

    176 of 310, each recorded against its serial number

  • Destruction Standard

    BS EN 15713:2023, the NIST 800-88 Destroy method

  • Disruption

    Two out-of-hours visits, no fee earner desk time lost

  • Cost

    Free. Recovered value covered the collection in full

Why Law Firms and Chambers Trust Surplex

Surplex UK Limited works with sole practitioners and single-site firms through to multi-site practices, and there is no minimum quantity, so a single laptop is booked the same way as a full refresh. Collections are free for most customers because the value recovered from redundant hardware is set against the cost of collection, destruction and recycling. Where it does not cover that cost, a small logistics and processing fee is payable, agreed upfront.

Team Meeting 1

Frequently asked questions

Yes. The mobile unit shreds drives at your premises so the data never leaves the building, and you can witness it. Destruction is carried out to BS EN 15713:2023 and a certificate is issued against each device serial number before we leave.

A certificate of destruction naming every device serial number, an itemised asset report separating data-bearing devices from the rest, WEEE evidence notes for the recycled fraction, and confirmation of zero to landfill. The reporting is built so an auditor can trace one specific machine.

No. Collections are routinely scheduled out of hours or at weekends, and on this programme both visits were outside office hours so no fee earner lost desk time.

No. There is no minimum quantity, and a single laptop is booked the same way as a full estate. Most customers find their collection is free, because the value recovered from redundant hardware is set against the cost. Where it does not cover it, a small logistics and processing fee is payable, agreed upfront.

Capabilities Used in This Project

Get in Touch About Your IT Recycling Needs

We provide IT recycling services for organisations of all sizes across England, Wales and Scotland.

Whether you’re recycling a few old laptops, decommissioning a data centre, or need secure data destruction, our team will help you dispose of IT equipment compliantly and responsibly.

Prefer to speak with us directly?

Call: +44 (0)1684 252583
Email: info@surplex.co.uk
Monday-Friday, 9am-5pm