Every year around June 30, Victorian businesses return stacks of leased laptops, desktops, and servers to finance companies and leasing providers. Most assume the hardware leaves with the problem. It doesn’t.
Under the Australian Privacy Act 1988 and Australian Privacy Principle 11 (APP 11), your obligation to protect personal information does not end when you hand back the device. It ends when that data is verifiably destroyed. The lease agreement handles the asset. It almost never handles the data.
What the Lease Says (and Doesn’t Say)
Standard equipment leasing contracts cover the physical return of hardware in reasonable working condition. Data is out of scope. Most lease terms say nothing about data sanitisation, and those that do typically require you to remove data before return — not that the lessor will do it for you.
When a lessor refurbishes and resells returned hardware, it does so under no obligation to your data. If employee records, customer information, or confidential business files remain on that drive, that is your breach — even though you no longer own the device.
The Office of the Australian Information Commissioner (OAIC) has been clear on this: APP 11 requires organisations to take “reasonable steps” to protect personal information, including at end-of-life. Returning hardware without evidence of data destruction is not a reasonable step.
Sector Obligations Compound the Risk
For Victorian healthcare providers, the Health Records Act 2001 adds a parallel obligation. Legal firms carry duties under professional conduct rules. Financial services businesses face ASIC and prudential requirements on data handling. These are layered on top of APP 11, not alternatives to it.
Returning a lease without data destruction certificates is not a compliance gap. It is an open liability.
What the Sanitisation Process Actually Requires
NIST 800-88 Rev. 2 defines three levels of media sanitisation:
- Clear removes data using standard read/write commands. Adequate for devices being repurposed within the same organisation.
- Purge removes data to a level that cannot be recovered with current forensic tools. This is the minimum standard for enterprise hardware leaving the organisation.
- Destroy physically renders the media unreadable. Used for high-security environments or devices that cannot be safely sanitised in place.
For most leased hardware returns, Purge is the minimum required. A factory reset does not meet this standard. It leaves data recoverable.
The Paper Trail Matters as Much as the Process
After sanitisation, you need documentation that ties the destruction to a specific device. A per-serial-number certificate tells an auditor exactly what was done, when, and by whom.
A batch certificate listing “100 laptops sanitised on 28 June” does not answer the audit question: was mine included?
EWV aligns its processes with NIST 800-88 Rev. 2, AS/NZS 5377, ISO 14001, and ISO 27001, and issues per-device certificates through our CircularTrack system. Every certificate is retrievable by serial number — no need to chase records from a third-party provider months later.
Arrange the Handover, Not Just the Return
If your leases are expiring this month, the time to organise data destruction is before the return date, not after. Once hardware leaves your facility, your options narrow sharply.
EWV can collect from your site, process devices to the required sanitisation level, and issue certificates before hardware goes back to the lessor. We work around lease return logistics — you do not need to hold equipment between the two processes.
The Victorian e-waste landfill ban also applies here. Leased IT equipment cannot go to landfill regardless of who the registered owner is at the point of disposal. If the lessor sends returned hardware to landfill, you still carry exposure under the ban.
Before 30 June
Returning leased hardware is not the same as destroying the data on it. Under Australian privacy law, you remain responsible until destruction is documented and verifiable.
Get the data destruction arranged before your lease return date. Contact EWV to schedule a collection this week.