Start with what holds data

An office clear-out usually starts with the furniture, because it’s the biggest and most visible. Start with data instead. Walk the premises and list everything that might hold personal or confidential information:

  • Filing cabinets, pedestals, archive boxes and the storeroom.
  • Laptops, desktops, servers and network storage.
  • External hard drives, USB sticks, memory cards and old backup tapes.
  • Phones and tablets, including old ones in drawers.
  • Printers, copiers and scanners, many of which have a hard drive that keeps copies of what was printed or scanned.
  • CCTV recorders, door access systems and visitor management tablets.

Lock that list down before anything else leaves. It’s easy for a box of files or a laptop to go out with the furniture by accident, and once it has, you can’t get it back.

What the PDPA expects

Two obligations in the Personal Data Protection Act matter most in a clear-out. The Protection Obligation requires reasonable security arrangements against unauthorised access, disposal and similar risks, and against losing any device or storage medium that holds personal data. The Retention Limitation Obligation requires you to stop keeping documents containing personal data, or anonymise them, once they no longer serve the purpose they were collected for and there’s no legal or business reason to keep them.

The PDPC’s advisory guidelines are specific about what “stop keeping” means: returning the documents, destroying them, for example by shredding, or anonymising the data. Locking files away, sending them to a warehouse, or moving them to another party you control all still count as keeping them. So a lease-end clear-out is a good moment to destroy what you no longer need, rather than paying to store it.

For computers and other hardware, the PDPC’s guide to data protection practices for ICT systems says to wipe or destroy data securely before disposing of equipment, using physical destruction, degaussing or a shredding service.

Paper files

First, separate what you must keep. Accounting, tax and employment records have legal retention periods, so check them with your accountant before anything is destroyed. Then deal with the rest in one of two ways: shred it on site, or use a secure destruction service that collects in locked bins and gives you a certificate afterwards. IMDA’s short guide to disposing of personal data covers the methods: shredding, pulping and incineration.

Never put personal files in general recycling, a skip, or a bin bag with the office rubbish. Once it has left your control, you can’t show what happened to it.

Computers, phones and drives

Deleting files and emptying the recycle bin leaves the data recoverable, and so does a quick format. For a device you’ll reuse, sell or donate, use a proper sanitisation method that overwrites or cryptographically erases the storage. For drives that have held sensitive data, or that won’t wipe, physical destruction is the safer choice.

Keep a register as you go: the device, its serial number, how it was wiped or destroyed, when, and by whom. It takes minutes per device and it’s the record you’ll want if anyone ever asks.

Licensed e-waste recyclers are themselves required to erase or destroy the data on devices they receive. Treat that as a second line of defence, not the first: wipe the devices before they leave, and keep your own record.

E-waste has its own route

Old computers, screens, printers and phones are waste like anything else in a clear-out, and any business that disposes of waste must use a collector licensed by NEA. An unlicensed “free pickup” is one way office equipment ends up dumped, and NEA has prosecuted operators who took customers’ furniture and debris and dumped it instead of paying for disposal.

For larger equipment there’s a free route. Since July 2021, producers of regulated non-consumer electronics, such as servers, network switches, printers over 20 kg and industrial batteries, have had to collect units they supplied when a customer asks. They can’t charge for collection or disposal, though they may charge for dismantling. NEA’s e-waste page lists the products covered.

Household channels don’t cover offices. ALBA’s free doorstep collection of large appliances is for homes only.

Keep the paperwork

By the end, you should have a destruction certificate for every batch of files and devices, the device register, and a note of where the rest of the e-waste went. File them with the lease-end records. If a question about a data leak ever comes up, that file is how you show the clear-out was handled properly.

Questions people ask

Is deleting files or formatting a laptop enough?

No. Deleted files and quickly formatted drives can often be recovered with freely available tools. Use a sanitisation method that overwrites or cryptographically erases the drive, or have it physically destroyed, and record which you did.

Can we donate or sell our old laptops?

Yes, once they’ve been properly wiped and you’ve recorded how. Remove any company asset tags and log the devices out of your management and security systems first, so they aren’t still linked to your accounts.

What happens if personal data is disposed of carelessly?

The PDPC can impose a financial penalty of up to S$1 million, or up to 10% of annual Singapore turnover for an organisation whose turnover there is above S$10 million. Beyond the penalty, a data leak from a clear-out is hard to explain to the people whose data it was.

Can we just box up old files and put them in storage?

You can, but under the PDPA stored files still count as files you’re keeping. If there’s no longer a legal or business reason to keep them, the obligation is to destroy them or anonymise the data, not to move them somewhere else.

Official sources

Rules, fees and timelines change. These are the bodies that set them, so check the current position with them before you act on anything here.

Last reviewed 28 September 2026. This is general information about how things usually work in Singapore, not legal advice on your situation. If something here is out of date, please tell us at hello@swyftclear.com.