Just over one in four Canadian businesses had written cyber security policies in place in 2023, according to Statistics Canada. Everyone else is improvising, and improvisation shows up fastest in secure device disposal for Greater Vancouver businesses.
The closet nobody audits
Walk through most offices in Vancouver, Burnaby or Richmond and you will find the same corner. A shelf of retired laptops. A shoebox of USB sticks. Two phones belonging to staff who left years ago.
Nobody decided to keep any of it. It simply was never dealt with, and the pile grew.
That pile is a records problem wearing a hardware costume. The Office of the Privacy Commissioner of Canada is blunt about the point. An organization holding personal information cannot simply throw that information in the trash. It has to find a way to dispose of it securely.
What the pile is actually holding
Think about what actually sits on a five-year-old laptop from an accounting or law practice. Client files, payroll exports, scanned identification, email archives going back to the day the machine was issued. None of that becomes less sensitive because the battery stopped holding a charge.
The OPC's list of electronic storage media runs wider than most owners expect. Computer hard drives are on it. So are copier and printer hard drives, removable drives and memory, disks, USB flash drives, mobile phones and magnetic tapes. The multifunction printer humming in the corner belongs on your disposal list.
Statistics Canada also found that identity theft climbed faster than any other attack method in 2023. Just under one-third of impacted Canadian businesses experienced it, an eleven percentage point jump from 2021. Retired equipment is one of the quieter places identity data waits.
Deleting is not erasing, and formatting is no better
When you delete a file, the operating system removes the pointer to it, not the file. When you reformat a drive, you rebuild the index, not the shelves. The data stays where it was until something writes over top of it. Free recovery tools can pull a great deal of it back.
The Canadian Centre for Cyber Security makes the same point in its guidance on IT media sanitization. Erasing a device and resetting it to factory default puts the data beyond the reach of the normal user interface. That stops casual snooping. The Centre notes that the data is normally not truly erased, and that erasure often cannot be verified.
What actually works depends on the media. For a modern magnetic hard drive, a single overwrite pass does the job. Solid-state and flash storage is harder, because wear leveling scatters writes across the chip and retired bad blocks can hold data that no erase command reaches.
Methods the federal guidance recognizes:
- Overwriting or secure erase, dependable on magnetic hard drives and unreliable on much flash storage
- Crypto erase, which destroys the encryption key on a device that was encrypted from its first day
- Degaussing, useful for magnetic tape and older magnetic media, and useless on anything solid state
- Physical destruction through shredding, disintegration, crushing or incineration, best applied after erasure rather than in place of it
- Verification, meaning a sample of the media is checked afterward to confirm the erase worked
That last step is the one that gets skipped. The Cyber Centre treats verification as essential and advises choosing a different method whenever the results cannot be checked. It also warns against leaning on physical destruction alone, since dense modern memory components can survive a partial crush with data intact. Skipping verification is the most common gap in secure device disposal for Greater Vancouver businesses.
What Canadian privacy law asks of a retired device
The duty to destroy
PIPEDA states that personal information no longer required to fulfil its identified purposes should be destroyed, erased or made anonymous. It also says organizations shall develop guidelines and implement procedures to govern that destruction. A second clause requires care in disposal so unauthorized parties cannot gain access.
Most companies operating entirely inside British Columbia answer to the province's Personal Information Protection Act instead. Section 35 requires an organization to destroy documents holding personal information, or strip out the means of linking that information to individuals. The trigger is the point where the collection purpose is no longer served and retention is no longer necessary for legal or business reasons. Different statute, same obligation.
Neither law prescribes a wiping standard or names a vendor. Both assume you have already decided what gets kept, for how long, and what happens at the end of that period. Small firms tend to skip exactly that decision, then improvise under pressure on the day the equipment goes out the door.
Sensitivity raises the bar further. The OPC singles out categories such as health and financial data, ethnic and racial origin, biometric identifiers and religious belief as warranting stronger handling. A medical clinic or an HR consultancy in Greater Vancouver is holding a heavier obligation than a firm whose worst-case disclosure is a stack of quotes.
Copies count as well
OPC guidance is specific that disposal includes destroying all associated copies and backup files. A properly wiped laptop achieves very little if the same client folder sits on an external drive one shelf over. The device you remember is rarely the only place the data lives.
This is why a retention schedule does more work than any single tool. The OPC recommends keeping an inventory of what personal information is held, for what purpose and for how long, then reviewing those holdings on a regular cycle. Once someone has decided how long a record should live, disposal stops being a judgement call made in a hurry.
Retention and disposal also pull in opposite directions, which is where the schedule earns its place. Tax rules, employment standards and limitation periods set floors you cannot go below. Privacy law sets a ceiling you should not sit above. The gap between the two is the window in which disposal actually happens.
Where custody quietly breaks
Handing a pallet of old gear to a recycler feels like the end of the story. Under Canadian privacy law it is not. The OPC is explicit that an organization contracting out disposal remains responsible for the information being disposed of.
Worth requiring from any disposal vendor:
- Verifiable credentials rather than a website and a truck
- Secure transfer of the equipment from your office to their facility
- A destruction method matched to the media type and the sensitivity of the data
- Privacy protection clauses in the contract that bind any subcontractors
- Monitoring and audit rights, including the occasional spot check
- A written record of what was destroyed, by what method, and on what date
Federal guidance goes a step further on the handoff itself. It advises erasing media or rendering it non-functional before it ships to an external destruction service. Where that is not possible, the equipment should travel and be stored securely, and the destruction should be witnessed.
The Cyber Centre describes chain of custody as chronological documentation of everyone who has held the media and every action taken on it. It starts when a device is flagged for sanitization and continues through transport and final disposal. That sounds heavy for a forty-person firm. In practice, secure device disposal for Greater Vancouver businesses runs on a spreadsheet, a locked cabinet and a signed receipt.
The exits nobody labels disposal
A pile of dead laptops is at least visible. The larger exposure sits in equipment that leaves through ordinary business channels, where nobody thinks of it as disposal at all.
Common blind spots:
- Leased copiers and multifunction printers returned at the end of term with their internal drives untouched
- Trade-in credit programs for phones, tablets and laptops
- Staff purchasing their old equipment on the way out the door
- Donations to schools, charities or community organizations
- Office moves, where boxes travel and a few never arrive
- Warranty replacements, where a failed drive goes back to the manufacturer holding everything it ever stored
The OPC calls out relocations directly. When an organization is planning a move or closing its doors, personal information should be safeguarded or securely disposed of in line with retention requirements. Offices across the Lower Mainland relocate constantly, and moving week is exactly when inventory discipline earns its keep.
Copiers deserve their own line. Federal guidance treats multifunction devices as holding real user data, not just configuration settings. Where the device does not support a properly evaluated overwrite function, the storage should be removed and sanitized. A factory reset from the control panel is not the same thing.
Making retirement a routine
The OPC suggests naming a designated person responsible for arranging data destruction, then instructing staff to route every retired device and every piece of electronic material to that person. One name, one path. It removes the moment where a laptop goes into a drawer because nobody was sure who to hand it to.
The same guidance advises segregating equipment awaiting disposal and storing it in a secure area with restricted access. In plain terms, that means a locked cabinet rather than the shelf by the kitchen. Devices in limbo are still live records, and they are easier to walk off with than anything on your network.
A routine that holds up:
- Inventory everything that stores data, copiers and phones included
- Give one person accountability for the retirement stage
- Encrypt devices from day one, which makes end-of-life erasure far simpler
- Hold retired equipment in a locked, access-controlled space
- Erase, verify, and destroy the media when verification fails
- Log each device, its disposal method and the date it left
Encryption is the quiet winner in that list. The Cyber Centre notes that media encrypted throughout its life can be sanitized quickly at the end, because destroying the key destroys access. Decisions made when a laptop is first issued determine how much work its retirement takes.
None of this calls for a large IT department. Secure device disposal for Greater Vancouver businesses mostly comes down to deciding who owns the final step of the hardware lifecycle, then writing down what happened at each stage.
Procurement gets planned. Deployment gets planned. Retirement tends to happen by accident, in a closet, on a loading dock, or in the back of somebody's car.
The data on those drives is indifferent to which. It stays readable until a deliberate step makes it otherwise.
Sources:
Statistics Canada, The Daily, Impact of cybercrime on Canadian businesses, 2023: https://www150.statcan.gc.ca/n1/daily-quotidien/241021/dq241021a-eng.htm
Office of the Privacy Commissioner of Canada, Personal Information Retention and Disposal: Principles and Best Practices: https://www.priv.gc.ca/en/privacy-topics/privacy-for-businesses/appropriate-handling-of-personal-information/gd_rd_201406/
Canadian Centre for Cyber Security, IT media sanitization (ITSP.40.006): https://www.cyber.gc.ca/en/guidance/it-media-sanitization-itsp40006
Personal Information Protection Act (British Columbia), section 35: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01
