NanosoftNanosoft
Sector expertise

Law Firm IT Disposal: Privilege Protected to Destruction

Retired fee-earner laptops, document management servers and networked copiers hold privileged client material, and under SRA guidance responsibility for confidentiality stays with the firm when disposal is outsourced. We keep the chain short: one named team, no subcontracted handovers, witnessed destruction where privilege demands it, and documentation built for Lexcel files and partner scrutiny.

Get a free assessment0800 677 1344
ISO 27001NIST 800-88WEEE CompliantCyber Essentials
Storage media reduced to fragments by the industrial shredder at the Nanosoft facility
Inside our UK facility
Storage media reduced to fragments by the industrial shredder at the Nanosoft facility
The short answer

Who provides IT asset disposal for law firms and chambers?

Nanosoft disposes of IT equipment for solicitors, chambers and in-house legal teams with witnessed onsite destruction, per-serial certificates and serialised chain of custody, handled end to end by one accountable team with no subcontracted handovers. Privileged material can be destroyed before it leaves your building, and the audit pack is structured for Lexcel evidence and SRA scrutiny.

Compliance

What the rules require, and how we evidence it

The regimes below are the ones your auditors and regulators actually cite. For each, here is what it requires of your organisation and the evidence we put in your hands.

SRA Codes of Conduct, paragraph 6.3

Solicitors and firms must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. SRA guidance confirms that firms remain responsible for confidentiality when services are outsourced: the disposal contractor acts, but the firm answers.

How we evidence it

A single accountable team with no subcontracted handovers, serialised custody from your office to verified destruction, and evidence your COLP can rely on to show confidentiality was maintained to the end of the device lifecycle.

Lexcel v6.1

The Law Society practice management standard requires an information management and security policy, recommends Cyber Essentials, and at section 5.2 requires firms to manage the risks presented by outsourced providers, disposal contractors included.

How we evidence it

Engagement documentation, custody records and per-serial certificates structured to slot into your Lexcel evidence for information security and outsourced services, ready for assessment without reassembly.

Legal professional privilege

Privilege attaches to the material, not the medium. Advice and litigation material on a retired device remains privileged, and exposure through careless disposal is a breach that no application to the court can fully repair.

How we evidence it

Witnessed destruction options, including onsite shredding at your offices, so privileged material never leaves the building intact, with per-serial certificates issued before our crew departs.

What you receive

Deliverables on every legal engagement

  • Witnessed onsite destruction at your offices, with certificates issued on the spot
  • Per-serial certificates of data destruction for every data-bearing asset
  • Chain of custody with numbered tamper-evident seals and GPS-tracked transit
  • Conflict-sensitive handling under a single named project manager
  • A consolidated audit pack delivered within 10 working days
The Nanosoft mobile shredding unit that destroys drives at client premises
The Nanosoft mobile shredding unit that destroys drives at client premises
The stakes

What goes wrong without evidence

Privileged material on unaccounted drives

Document management servers, fee-earner laptops and copier hard drives hold privileged material long after matters close. A single unaccounted drive is a confidentiality breach in waiting, and it is the firm, not its disposal contractor, that answers to clients and the SRA.

Subcontractor custody breaks

Many disposal firms pass collections to couriers and third-party processors the moment they leave your building. Every handover is a gap in the custody record, and a firm that cannot say who held its media at each step cannot demonstrate the confidentiality the SRA Codes require.

Uncertified disposal surfacing in audits and tenders

Lexcel assessments, client due diligence questionnaires and panel tenders increasingly ask how retired IT was disposed of. A gap in the evidence, or a batch certificate that names no serials, surfaces at exactly the moment the firm is trying to win or keep work.

Drives sanitised at supervised erasure stations in the Nanosoft facility
Drives sanitised at supervised erasure stations in the Nanosoft facility
A witnessed shredding session led by a Nanosoft engineer
A witnessed shredding session led by a Nanosoft engineer
Serialised asset scanning maintaining chain of custody at the Nanosoft facility
Serialised asset scanning maintaining chain of custody at the Nanosoft facility
Common questions

Frequently asked by legal clients

Yes. Our mobile shredding unit destroys drives at your premises to NIST 800-88 Destroy, witnessed by your risk or compliance staff, with per-serial certificates issued before we leave. Media holding privileged material never leaves the building intact, which is the cleanest answer a COLP can give to a nervous client.

Your firm. SRA guidance is clear that outsourcing a service does not outsource the obligation: paragraph 6.3 of the Codes of Conduct keeps client confidentiality with you. Our job is to make that retained responsibility demonstrable, with serialised custody, named handlers and per-device destruction certificates your firm controls.

Lexcel v6.1 requires an information management and security policy and, at section 5.2, management of outsourced providers. We supply engagement documentation, due diligence information, custody records and per-serial certificates in one pack, so the disposal element of your information security evidence is complete before the assessor asks.

Daily. The City, Canary Wharf and midtown are under an hour from our Essex facility, and loading-bay bookings, lift reservations and out-of-hours access are routine; see our London coverage page for detail. Regional and multi-office firms get one project manager, one collection programme and one consolidated audit pack.

Four things: who physically handles the media at every step, whether certificates name individual serials, what happens to devices with resale value, and what evidence arrives afterwards. Our guide on how to choose an ITAD provider sets out the full checklist, and we are happy to be measured against it.

Your audit pack is yours to keep permanently, and we retain our copy of certificates and custody records long term, re-issuing historical documents on request if an audit, tender or investigation reaches back. Tell us the retention requirement your firm works to, and we will match it.

Our own DBS-checked crews collect from your offices, the vehicle is ours and GPS-tracked, and processing happens at our own Essex facility. Where downstream materials recycling is needed, audited partners work under our chain of custody and are recorded in your audit pack, keeping one accountable relationship for your firm to oversee, which is precisely what Lexcel section 5.2 asks you to manage.
Keep reading

Related reading

Ready to dispose of Legal IT equipment with the evidence built in?

Same-day quote, no obligation. Tell us what you have and where it is, and we confirm a collection slot and a fixed price the same day.

Get a free assessment0800 677 1344
ISO 27001NIST 800-88WEEE CompliantCyber Essentials