The Disposal Gap: Why Windows 10 Retirement Is a Procurement Test, Not an IT Task

The estate you can see and the estate you cannot

When Windows 10 support ended in October 2025, most UK organisations responded with a familiar list: extend support for a subset of machines, accelerate a Windows 11 refresh, and defer the awkward question of what to do with the hardware left behind. A year on, that deferral has become a procurement problem rather than an IT one. The devices that remain are often not the ones on the asset register. They are in storerooms, with former employees, at suppliers, in lease-return queues, or waiting for a disposal decision that nobody owns.

The visible risk is an unsupported operating system. The less visible risk is what happens to the data on those devices when they leave the organisation. A Windows 10 retirement programme is therefore not a software migration with a hardware tail. It is a chain-of-custody exercise, and procurement is where it succeeds or fails.

The quote that hides the cost

Disposal quotes vary widely, and the variance is rarely about margin alone. At one end sits a certified IT asset disposal provider offering audited collection, serial-level reporting, verifiable sanitisation and a documented downstream route for components. At the other is a low-cost collector who will remove the kit quickly and provide a certificate that amounts to a signature on a page.

The cheapest quote is not necessarily non-compliant. But it is the one most likely to leave gaps that procurement teams discover only when an auditor, a regulator or a customer asks a specific question: where did the drives go, who wiped them, against which standard, and what evidence exists that the wipe succeeded? Under UK GDPR, the controller remains responsible for personal data even after the hardware leaves the building. A disposal contract does not transfer that accountability.

This is why the procurement question should shift from price per unit to evidence per asset. Ask for the sanitisation method — usually a recognised standard such as NIST SP 800-88 or a certified erasure platform — and ask how the provider proves it on a device-by-device basis. A blanket certificate covering a pallet is not the same as a serial-level report showing a successful erase on each machine.

A retirement sequence that survives audit

The practical sequence is less glamorous than a refresh programme, but it is the one that holds up under scrutiny.

First, reconcile the estate. Match finance records, helpdesk tickets, mobile device management data and lease schedules against physical stock. The objective is not a perfect inventory; it is a defensible one. Note devices that are missing, devices that are retained for testing, and devices that are still in use because a business unit has not released them.

Second, classify before you collect. Separate devices that hold personal data, commercial data or regulated data from those that do not. This determines the sanitisation standard and the evidence required. It also prevents a common failure mode: treating every laptop as identical until a drive fails during erasure and nobody knows what was on it.

Third, select a provider against certification and downstream transparency. In the UK, look for ADISA certification or equivalent, a current waste carrier registration, and a clear statement of where equipment goes after collection. A provider that cannot describe its downstream partners is a provider that cannot assure the final destination of your data.

Fourth, contract for reporting, not just removal. The statement of work should specify serial-level asset reports, sanitisation certificates, weight and WEEE reporting, and a defined escalation route for devices that fail erasure. Those failed devices should be physically destroyed, with destruction evidenced, rather than quietly returned to stock.

WEEE, waste duty of care and the paper trail

Disposal is also a waste-management activity. The WEEE Regulations place obligations on producers and distributors, but any organisation discarding electrical equipment still has a duty of care under the waste hierarchy. That means using an authorised carrier, keeping transfer notes, and being able to show that waste was handled lawfully.

Procurement teams do not need to become environmental specialists. They do need to make the paper trail a contractual deliverable. A consignment note that lists "mixed IT equipment" is weak evidence. A report that lists asset tags, weights, treatment routes and final destinations is stronger. If the board is later asked about scope 3 emissions or waste volumes, that same report becomes the data source.

Resale, reuse and the sustainability ledger

Resale value is real, but it is not the same as recovered value. A device sold through a broker may fetch a headline price and still create a data risk if sanitisation is not verified. Reuse through a reputable charity or refurbisher can be a better outcome, provided the data erasure is certified and the recipient can support the device.

The sustainability numbers now land in board reporting. Extending the life of a device by twelve to eighteen months avoids manufacturing emissions and reduces waste, but only if the device is genuinely usable and not simply moved to another shelf. The strongest procurement position is a hierarchy: reuse where it is safe and supported, recover components where it is not, and recycle only what remains. Each step should be evidenced.

What the board should ask

Three questions are enough to expose most disposal gaps. Who owns the retirement register, and is it reconciled to finance? Which provider is certified to sanitise and transport the equipment, and what evidence will it supply per device? And what is the total cost of evidence — not just collection, but reporting, failed-erase handling and audit support?

The Windows 10 estate will not disappear because support ended. It will disappear through a sequence of procurement decisions, each of which either closes a risk or moves it somewhere less visible. The organisations that treat disposal as a supply-chain exercise, rather than a clearance task, will be the ones able to answer the question that matters: where did the data go?