The Supplier Holding Your Data: What the Police Cyber Report Means for IT Disposal

The police and fire inspectorate published a report on cybersecurity on 27 October 2026. One finding matters to anyone who hands data to somebody else: in the attacks the inspectorate was told about, it was the suppliers holding police information that were compromised, not the police systems themselves.

This piece sets out what the report found about supplier assurance, what it does not cover, and which of its lessons carry over to the company you pay to collect, erase and destroy your old IT equipment.

What the inspectorate found

His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published Cybersecurity in police forces and fire and rescue services on 27 October 2026, with 13 recommendations. Its chapter on third-party ICT suppliers says the Police Digital Service and the National Police Chiefs' Council shared information on multiple cyberattacks between 2021 and 2025 in which police data was at risk. The report's wording: "None involved a direct attack on police ICT systems. Worryingly, it was the third-party ICT supply chains which held police information that had been compromised."

The report gives no count of those attacks and names no supplier. It says the full inspection report held operational detail that was not suitable for the public domain, and that the published version leaves it out.

What it does describe is how the six organisations it inspected managed their suppliers. Among its examples, these are worth reading slowly:

• Assurance faded. Assurance processes were "inconsistently applied and, even when strong at the point of procurement, they became weaker or absent as time went on".
• Contracts did not ask for ongoing checks. The inspectorate found that "most of these third-party contractual arrangements didn't include any ongoing cybersecurity assurance arrangements".
• Some certificates were accepted at face value. Organisations "accepted CE/CE+ and ISO certificates without verifying what systems they applied to".
• Not every organisation had the full list. Some organisations "didn't keep an authoritative list of all the suppliers they shared sensitive data with".
• Chains of suppliers blurred responsibility. The inspectorate found that multi-layered supply chains made "it unclear who was responsible for what".

On contracts, the inspectorate found significant variation in reporting timescales for breaches, audit and inspection rights, data retention, incident notification, access to logs and liability. Some forces and services did not hold the original contract documentation for systems provided through shared or national arrangements, so staff could not always confirm whether the supplier was required to notify them promptly of a cybersecurity incident.

What the report does not cover

It is about ICT suppliers: hosted systems, case management, control rooms, HR and payroll. The words disposal, decommissioning and destruction do not appear in it. Nothing in the report says an IT disposal company has been attacked, and we are not suggesting one has.

Our reading is narrower. The question running through the report is who holds your data and how you know they are still looking after it. That question applies to every supplier that touches it. A disposal company is one of them.

Why the disposal supplier is on that list

Under UK GDPR, a controller must "use only processors providing sufficient guarantees" of appropriate technical and organisational measures (Article 28(1)). The ICO's guidance on contracts says deletion "should be done in a secure manner, in accordance with the security requirements of Article 32". In our reading, a supplier that erases or destroys drives holding personal data on your behalf is acting as your processor. That is our inference, not ICO wording, so take advice if your situation is unusual. The ICO also notes that its contracts guidance is under review following the Data (Use and Access) Act, so check the live page.

There is also a practical point. Between collection and destruction, a disposal supplier holds your devices with the data still on them. In our view that is a period of real exposure, and like the hosted systems the inspectorate describes, it sits outside your own monitoring.

The NCSC makes the general point in its supply chain security guidance: citing the 2025 Security Breaches Survey, it says "very few UK businesses set minimum security standards for their suppliers".

Seven questions to put to your disposal supplier

1. Is there a written contract with the Article 28(3) terms? It must cover processing only on your documented instructions, confidentiality, security measures, sub-processors, help with individuals' rights and breaches, deletion or return of data, and audits. The ICO lists each term in what needs to be included in the contract.
2. Who actually handles the devices? Article 28(2) says a processor must not engage another processor without your written authorisation. Ask for every party in the chain, including transport and downstream recycling, and for the flow-down terms.
3. What does the certificate cover? This is the inspectorate's finding in one line. Read the scope wording, the named site and the dates. Then confirm it with the issuing body, quoting the certificate number, instead of relying on a logo.
4. How quickly will they tell you about an incident? Article 33(2) says a processor must notify the controller "without undue delay". You carry the 72-hour clock to the ICO, so put a number of hours in the contract.
5. Can you audit them, and will you? Article 28(3)(h) requires the processor to allow audits and inspections. The report suggests the real gap is the second half: assurance that is strong at signing and absent a year later. Diarise a yearly check.
6. What evidence do you get for each device? A bulk "destroyed" statement is not enough. Ask for serial-number level records with the method, date and result. Our ITAD documentation checklist lists what that record should hold, and our article on spotting a fake certificate of destruction shows how to test one.
7. Is the supplier on your supplier list? Include every firm that takes data-bearing equipment away: the disposal company, the lessor that collects copiers, the phone recycler. If it is not on the list, nobody is reviewing it.

Our own position, for disclosure

We are a disposal supplier, so weigh this section accordingly. Our ISO/IEC 27001:2022 certificate is number 0227562, issued by Intertek Certification Limited, valid until 13 October 2028. Intertek is accredited by UKAS under schedule 0014. The scope reads: an information security management system covering all activities related to IT asset disposition, including secure collection, storage, data sanitisation, hard drive shredding, refurbishment, resale and environmentally responsible recycling of IT equipment. The certificate PDF is public, and Intertek confirms validity at certificate.validation@intertek.com when you quote the number.

Our own DBS-checked crews handle every UK collection and all processing happens at our Essex facility. Where an engagement needs specialist EU delivery legs or downstream materials recycling, we use audited partners working under our chain of custody, and their role is recorded in your audit pack. Test that against the seven questions above rather than taking our word for it. Our guide to choosing an ITAD provider sets out the same checks in more detail.

The honest summary

The inspectorate found that the weak point was often the supplier holding the data, and that checks made at signing did not last. A disposal company handles your data at its most exposed. Put it on your supplier list, read what its certificate covers, get incident notification and audit rights into the contract in writing, and check again every year.