Point-of-sale systems are the backbone of retail and hospitality operations, processing thousands of transactions and handling sensitive payment data every day. When it comes time to replace or upgrade POS equipment, the disposal process requires more thought than most business owners give it. The combination of payment card data, customer information, and employee records stored on POS systems makes proper disposal a security imperative, not just an environmental one.
What Makes Up a POS System?
Modern POS systems are more than just a cash register. A typical setup includes a touchscreen terminal or tablet, a receipt printer, a barcode scanner, a cash drawer, an EFTPOS or card reader terminal, and often a back-office server or computer that stores transaction data. Some systems also include customer-facing displays, kitchen display screens (in hospitality), label printers, and loyalty card readers.
Each of these components has different recycling requirements. The terminals and back-office computers contain data-bearing storage that needs secure destruction. The peripherals contain various materials including metals, plastics, and electronic components that need proper recycling. And the EFTPOS terminals are subject to specific payment industry regulations around disposal.
The Data Security Risk
POS systems can store an alarming amount of sensitive data. Depending on the system and how it has been configured, the storage may contain transaction records including credit card numbers (if the system is not PCI DSS compliant, or if legacy data exists from before compliance was implemented), customer databases with names, contact details, and purchase history, employee records including clock-in/out data and personal information, supplier information and pricing data, and loyalty program member details.
Even if your current POS system is fully PCI DSS compliant and does not store full card numbers, older data may still exist on the system’s storage from before compliance measures were implemented. Additionally, transaction logs and receipts stored in databases may contain partial card numbers, customer names, and other information that could be useful to identity thieves.
For more on secure data destruction obligations, see our complete guide to data destruction for Australian businesses.
EFTPOS Terminal Disposal
EFTPOS and card reader terminals require special attention. These devices are certified by payment networks (Visa, Mastercard, etc.) and contain security modules that store encryption keys used in transaction processing. Payment industry rules typically require that decommissioned terminals be physically destroyed or returned to the payment processor.
In most cases, your EFTPOS provider owns the terminal and will arrange collection when the service is cancelled. If you own the terminal outright, check with your payment processor about their disposal requirements. Do not simply throw an EFTPOS terminal in the bin or donate it, as the security modules could potentially be exploited.
Step-by-Step POS Disposal
1. Export and Archive Necessary Data
Before decommissioning, export any data you need to retain. Tax regulations require businesses to keep financial records for at least five years, so ensure you have transaction summaries, sales reports, and GST records backed up to a separate, secure location. Check with your accountant about specific retention requirements for your industry.
2. Securely Destroy Data on All Storage
Identify every component in your POS system that contains storage. This includes the main terminal or computer’s hard drive or SSD, any back-office server storage, compact flash or SD cards in terminals, USB drives used for backups, and any removable media. Each storage device should be wiped using a NIST 800-88 compliant method, or physically destroyed if the device is too old or too small to wipe reliably. Obtain certificates of destruction for each device.
3. Return Leased Equipment
If any components are leased (EFTPOS terminals are almost always leased), arrange return to the provider. Check your lease agreement for return conditions and deadlines to avoid ongoing charges.
4. Recycle Remaining Equipment
Once data has been destroyed and leased items returned, the remaining equipment can be recycled through a professional e-waste recycler. POS terminals, receipt printers, barcode scanners, cash drawers, and display screens all contain recyclable materials including metals, plastics, and electronic components.
Recycling Individual POS Components
Touchscreen terminals are similar to tablets or all-in-one computers. They contain LCD or LED screens, circuit boards, and in many cases integrated storage. Process them as you would any data-bearing computer equipment.
Receipt printers (thermal and impact) contain motors, circuit boards, and rubber components. Thermal printers also contain a thermal print head that may contain trace amounts of heavy metals. These should go through e-waste recycling rather than general waste.
Barcode scanners are small electronics containing circuit boards, lasers or camera sensors, and plastic housings. Recycle through standard e-waste channels.
Cash drawers are primarily metal and plastic with a simple electronic lock mechanism. The metal content makes them straightforward to recycle through e-waste or scrap metal channels.
Customer displays and kitchen screens are LCD or LED screens that should be recycled following the same process as computer monitors.
Industry-Specific Considerations
Hospitality
Restaurant and cafe POS systems may be in harsher environments than retail systems, with exposure to grease, heat, and moisture. These conditions can accelerate degradation of the equipment but do not change the disposal requirements. Kitchen display screens, in particular, may have deteriorated housings but still contain functional circuit boards and storage that need proper handling.
Retail
Retail environments often have multiple POS terminals across several locations, making fleet disposal a logistical challenge. Coordinate with your ITAD provider to schedule collections across all locations, and ensure consistent data destruction procedures are applied to every terminal.
Healthcare
Medical practices and pharmacies using POS systems face additional obligations under the Health Records Act and related legislation. If your POS system has processed or stored patient information (which is common in pharmacy dispensing systems), data destruction requirements are more stringent.
For a comprehensive approach to managing all your IT equipment through its full lifecycle, see our complete guide to ITAD for Australian businesses.
EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.