EPOS equipment: clear the data before the shopfit leaves

Give a named person responsibility for coordinating the business, IT provider and payment or EPOS provider. That person needs authority to confirm the final record, not necessarily the technical skills to perform every task.

Use this release checklist for each identified device:

• Match its serial number to the hardware inventory.
• Confirm whether the business owns it or must return it.
• Identify local storage, removable media and connected accounts.
• Decide which business records need authorised retention.
• Arrange the provider-approved account and device release process.
• Use an appropriate erasure or destruction route for the device and data.
• Verify completion and record who approved release.
• Reconcile the device and accessories at handover.

The ICO's asset-management guidance supports accurate inventories and evidence of secure disposal. It is under review following the Data (Use and Access) Act, so review the current guidance when planning a real disposal.

Before clearing hardware, the business should identify sales, accounting, employee or customer records that must remain available. Retain the authorised records securely through an appropriate business process.

Do not make an unrestricted copy of customer information merely to empty a device. Decide who needs access and what the retention purpose is. The sale coordinator should not publish those records in a catalogue or pass them to the purchaser.

The business computer disposal guide covers the wider device process. Apply it to a back-office computer even if it is not located beside the till.

A payment terminal may have a separate owner and return process. EPOS software, subscriptions and remote management may have their own transfer or closure rules.

Ask the relevant provider what must be returned, removed from management, released or deactivated. Record the answer against the device. Do not give a purchaser the business's login as a shortcut.

For connected routers and managed switches, the network equipment guide addresses configuration data, account links and release evidence. Warehouse-style handheld devices use the scanner and terminal record instead.

ICO guidance on device data deletion explains why ordinary deletion or a device's failure to power on may not remove the risk of accessible information. Use a suitable method for the hardware and the sensitivity of the stored data. A reset should not be assumed sufficient without checking the manufacturer's or provider's relevant instructions and the actual result.

Keep evidence with the serial number, date, method and responsible provider or person. Where erasure cannot be verified, hold the device for an appropriate secure route instead of releasing it because collection is due.

Finally, check drawers, receipt rolls, removable storage and accessory boxes for records that sit outside the main device. The physical handover should match the cleared inventory.

Give UK Auction Group the hardware list and release status. Share device specifications and sale evidence, while retaining sensitive records in the business's controlled file. Do not describe data-clearing services as included unless separately agreed.

Retail and catering