Most schools have heard of the DfE’s digital and technology standards in the context of buying new laptops or reviewing broadband speed — less often in the context of what happens when a device reaches the end of its life. That’s partly because the standards don’t sit in one single “how to dispose of a laptop” document. They’re spread across several categories, and the disposal-relevant parts tend to get missed by anyone who hasn’t gone looking for them specifically.
For a school or multi-academy trust trying to stay compliant, it’s worth understanding what these standards actually expect, rather than assuming disposal falls outside their scope entirely.
What the DfE Digital and Technology Standards Actually Cover
The Department for Education’s digital and technology standards were introduced to help schools and colleges make more informed decisions about the technology they use, and they’re referenced directly in the Academy Trust Handbook, which states that trusts should refer to them when reviewing their technology decisions. The standards are organised into a set of categories covering areas like device standards, connectivity, cyber security, and digital leadership, rather than existing as a single checklist.
The most directly relevant section for disposal is the Laptop, Desktop and Tablet Standards, last updated in January 2024, which sets out expectations for how schools select, manage, and secure the devices they use. Read on their own, they’re mostly about procurement and day-to-day management. Read alongside the standards on data protection and asset management, they build a clearer picture of what’s expected once a device is retired.
Where Disposal Fits Into the Standards
Three areas end up mattering most when a device actually reaches end of life:
Asset Registers
Schools and trusts are expected to keep an asset register logging all physical digital technology — laptops, tablets, printers, servers, and similar equipment. This is separate from a financial fixed asset register; it’s specifically about knowing what technology exists, where it is, and by extension, what still needs to be accounted for when it’s retired. A device that isn’t properly removed from this register when it’s disposed of leaves a school with inventory that no longer matches reality.
Information Asset Registers
Alongside the hardware register, schools are expected to maintain a record of the data held on their systems and devices, typically owned by the data protection officer. This ties disposal directly to data protection compliance — a device can only be confidently signed off as disposed of once whatever data it held has actually been accounted for and destroyed, not just once the hardware itself has left the building.
Device Security and Data Protection Expectations
The standards are explicit that devices must support compliance with data protection law, including GDPR. That expectation doesn’t stop applying the moment a device is scheduled for disposal — if anything, it’s the point where it matters most, since a device leaving the school’s control is exactly when unaddressed data becomes a real risk.
What This Means in Practice for Schools
Put together, the standards point toward a disposal process that looks like this, even though no single document spells it out as a step-by-step guide:
- Keep the asset register current. Every device disposed of should be removed from the register at the point of disposal, not weeks or months later.
- Cross-reference against the information asset register. Before a device is retired, confirm what data it’s held and ensure that’s reflected in destruction planning, not just the physical disposal.
- Treat data destruction as part of device security, not a separate task. The same security expectations that apply to a device in use should extend to how it’s retired — certified wiping or destruction, not an assumption that switching it off is enough.
- Keep evidence, not just intentions. A certificate of destruction matched to a specific device gives a school something concrete to point to if a governor, auditor, or the DfE itself ever asks how a particular device was handled.
Why This Matters for Multi-Academy Trusts Specifically
The Academy Trust Handbook reference makes this particularly relevant for MATs, where the same standards are expected to apply consistently across every school in the trust, not just at the trust’s central office. A trust with ten schools each managing disposal informally and differently has, in practice, ten different levels of compliance with the same standard — which is exactly the kind of inconsistency that becomes obvious during a financial or governance review.
Centralising the asset register, the information asset register, and the disposal process itself across every school in a trust makes it far easier to demonstrate that the standards are being met consistently, rather than assembling evidence retrospectively when someone asks.
Bringing multiple school sites into line with DfE standards? Computer Data Shred provides certified data destruction and disposal across individual schools and full multi-academy trusts, with documentation matched to your asset register. Get in touch to discuss your trust’s requirements →
How This Connects to Wider School ITAD
DfE standards don’t exist in isolation from the rest of a school’s obligations — WEEE regulations and GDPR apply regardless of what the DfE’s own guidance says, and a school that’s meeting the DfE’s expectations around asset registers and data protection is generally already most of the way toward broader compliance too. Our guide to ITAD for schools covers how this fits together across Chromebooks, interactive whiteboards, and printers, and our piece on Chromebook disposal covers the asset register and deprovisioning issue in more device-specific detail.
Frequently Asked Questions
Do the DfE digital standards specifically require a certificate of data destruction? The standards don’t spell out a specific disposal checklist, but they do require devices to support data protection compliance and expect schools to maintain accurate asset registers. In practice, a certificate of destruction is the clearest way to evidence that a specific device’s data was properly handled, which supports both expectations.
Are the DfE standards legally binding, or just guidance? They’re referenced directly in the Academy Trust Handbook as something trusts should refer to when making technology decisions, which gives them real weight for academies specifically, even where they function as guidance rather than statute. Underlying legal obligations — GDPR and WEEE — apply regardless of the DfE’s own standards.
What’s the difference between an asset register and an information asset register? An asset register logs the physical hardware a school owns — laptops, tablets, printers, servers. An information asset register, usually owned by the data protection officer, tracks the data held on those systems. Disposal needs to account for both: removing the hardware from one register, and confirming the data referenced in the other has been properly destroyed.
Do these standards apply to maintained schools as well as academies? The direct Academy Trust Handbook reference applies specifically to academies and trusts, but the underlying expectations around data protection, device security, and asset management reflect good practice that applies just as much to maintained schools, even without the same handbook reference point.
How does a multi-academy trust demonstrate compliance across multiple schools? Usually through a centralised, consistent process — one asset register format, one information asset register approach, and one disposal and certification process applied across every school in the trust, rather than each site handling it independently.
Final Thoughts
DfE digital standards don’t hand schools a disposal checklist, but read alongside asset registers, information asset registers, and data protection expectations, they make it fairly clear what’s expected once a device reaches end of life: know what you have, know what’s on it, and be able to prove what happened to it. For a single school, that’s a manageable habit to build. For a multi-academy trust running the same expectation across several sites, it only works if the process is consistent everywhere, not left to each school to interpret on its own.
Want to make sure your school or trust’s disposal process actually holds up to DfE and GDPR expectations? Talk to our team about certified device disposal with documentation matched to your asset register, or call 0330 341 0786.
