Free ICO Training for Small Businesses: Where Old Laptops and Phones Fit

On 30 October 2026 Northern Ireland's Economy Minister urged small businesses and sole traders to use the Information Commission's Office's new free training, Data Protection Essentials. It is a sensible thing to do. But the ICO's own small-business guidance gives old laptops, phones and drives about one sentence, so it is worth checking how your business handles them.

This piece sets out what the programme offers, what we could and could not confirm about its content, and a short list for the part it may not cover: the equipment you retire.

What Data Protection Essentials is

The ICO's programme page describes a free online training and self-assessment programme for small and medium-sized organisations, their employees and sole traders. What it sets out:

• 13 bite-sized modules, each taking 10-15 minutes, done at your own pace, with up to 14 other people invited from your organisation.
• A short self-assessment at the end, with tailored advice.
• Digital certificates for individuals, and a certificate for the organisation, with the option of being listed on a public register.
• An annual refresh to keep certificates valid, and each year a small number of participating organisations are selected for a supportive review with an ICO expert.

It is aimed at organisations with fewer than 250 employees, no Data Protection Officer and no high-risk processing. The ICO says plainly that it is not an accredited certification scheme. The 30 October statement adds that it is free even for organisations exempt from paying the data protection fee.

What we could not confirm

Neither the programme page nor the statement lists the 13 modules. The statement names the activities covered: sharing information, managing records securely, marketing and customer engagement, and reducing the risk of data breaches. It does not mention equipment, devices or disposal, and we have not taken the course. So we cannot say whether retiring IT is covered, and nothing below should be read as a criticism of the content. It is a prompt to check for yourself.

What the ICO's small-business pages already say about old kit

The advice lives elsewhere on the ICO site. Its page of practical ways to keep your IT systems safe and secure has 11 tips. The last one is headed "Dispose of old IT equipment and records securely". The text says you "must" make sure no personal data is left on computers, laptops, smartphones or any other devices before you dispose of them, and that you "could" consider using deletion software or hire a specialist to wipe the data.

The page on destroying documents that are no longer needed adds three points. Deleted files can linger in recycle bins and back-ups. The two routes it offers are secure deletion software that overwrites data one or more times, or specialist IT advice. And if you hire someone to help, you should check their credentials and processes and have a contract in place. Both pages carry a notice that they are under review following the Data (Use and Access) Act, so check the live wording.

Where a small firm's gaps usually are

What follows is our reading, based on the ICO's text and on our experience as a disposal company. It is not ICO guidance.

1. The list. The ICO says "any other devices". Make a list of them: laptops, phones, tablets, USB sticks, external drives, and the copier or printer. Leased copiers are the one people forget.
2. The method fits the drive. The ICO's page suggests overwriting software. That is one method, and it does not suit every drive. NIST's media sanitisation standard says multi-pass overwrite is not needed, and for certain flash media such as "SSDs with overprovisioning" such practices "should be avoided as very little confidentiality protection is achieved". We cover the detail in our article on NIST 800-88 Revision 2.
3. Phones are not laptops. The ICO's sentence covers smartphones, but a phone has extra steps such as eSIMs and account locks. Our phone disposal article sets out the order.
4. The accounts stay behind. Wiping a laptop does not close the email, cloud and admin accounts that it was signed in to. We looked at this in our piece on the ICO's Password1 reprimand.
5. The contract and the proof. If someone else wipes or destroys your kit, the ICO says to check their credentials and have a contract. Ask what evidence you will get for each device. Our article on spotting a fake certificate of destruction shows how to test one.

Using the certificate sensibly

Finishing the course and the self-assessment earns a certificate, and the public register lets customers see it. That is useful for trust. It is not an accreditation, as the ICO says, and it does not show that a particular laptop was cleaned. Treat it as evidence that the people in your business have been trained, and keep a separate record of what happened to each device you retire.

For disclosure, we are an IT disposal company, so weigh the list above accordingly. The ICO pages quoted here are public, and each point can be checked against them.

The honest summary

The free training is worth an afternoon of a small team's time. The ICO's own small-business advice on old equipment is short: you must leave no personal data on devices you dispose of. Whether the course digs into the practical steps, we could not confirm. Do the course, then make the device list, match the method to the drive, close the accounts and keep a record of each device.