IT Disposal Compliance & Security Guide

Ownership & approval

Record who authorised retirement, what is in scope and who owns exceptions.

Asset control

Keep enough asset information to reconcile what leaves the organisation with what is received and processed.

Secure holding

Keep retired data-bearing equipment in controlled storage with limited access until handover.

Supplier due diligence

Check that providers are suitable for the data-security, transport and waste roles they perform.

Data sanitisation

Match sanitisation to the storage technology, sensitivity and residual risk.

Waste duty of care

Use authorised waste handlers and the transfer or consignment documentation required for the waste movement.

Evidence & records

Retain the evidence needed to show what was collected, how it was handled and the final outcome.

Exceptions & incidents

Record locked devices, failed wipes, missing identifiers, damaged media and route changes.

Confirm disposal authority

Identify the authorised business owner.

Define asset scope

Use serials, asset tags, device types or another agreed identifier.

Agree evidence level

Decide whether the project needs basic records, destruction-point audit or device-level evidence.

Secure equipment

Restrict access to devices awaiting handover.

Verify the collection

Reconcile the equipment against the approved scope.

Record the handover

Keep the transfer or chain-of-custody evidence appropriate to the project.

Check waste authorisation

Use authorised carriers and receiving sites where waste rules apply.

Protect assets in transit

Use handling controls proportionate to data sensitivity and project risk.

Identify storage technology

HDD, SSD/NVMe, mobile and removable media need media-appropriate processing.

Use the agreed method

Erase, degauss or physically destroy according to media and risk.

Record route changes

Failed wipes and unresolved locks should create an exception record.

Separate reuse from recycling

Only equipment that completes data-security checks should proceed to reuse.

Reconcile outcomes

Account for processed assets and material exceptions.

Issue agreed evidence

Provide certificates, serial lists, logs or method records included in scope.

Retain waste records

Keep applicable transfer or consignment documentation.

Review lessons learned

Use recurring exceptions to improve the next retirement project.

Identity & authority

Confirm the legal entity, service scope and relevant waste carrier, permit or exemption status where required.

Data-security process

Understand how data-bearing assets are identified, sanitised and handled when a wipe fails.

Physical security

Consider collection, transport, storage and access controls.

Evidence quality

Agree exactly what serial lists, logs, certificates and exception reports will be supplied.

Downstream route

Understand what happens after data security: reuse, value recovery, component recovery or recycling.

Contract & responsibility

Make service scope, reporting, confidentiality, escalation and incident responsibilities clear.

Does using a third party remove our responsibility?

No. Outsourcing does not remove the need to choose a suitable provider, define controls and retain appropriate evidence.

Is a Certificate of Data Destruction enough on its own?

It can form part of the evidence package, but some projects also need serial lists, method records, logs or chain-of-custody evidence.

Do we need a waste transfer note for every collection?

In England, non-hazardous business waste movements normally require a waste transfer note or alternative document containing the required information. Hazardous waste uses different consignment requirements. Check the current regulator guidance for the relevant UK nation and waste type.

Should devices be wiped before leaving site?

That is a risk decision. NCSC guidance says sensitive media should be sanitised before leaving organisational control; organisations can also define stronger third-party handling and evidence controls where appropriate.

How is this different from Regulations & Standards?

This guide is operational: ownership, controls and evidence. The Regulations & Standards pillar will explain individual legal and standards frameworks in more detail.