IT Asset Disposal (ITAD): A Guide to Secure Disposal

Every laptop, server, phone and drive your organization buys will eventually leave it. How it leaves matters. A device that walks out with readable data on it, or ends up in a landfill, can become a breach report, a regulatory finding or an environmental liability.

IT asset disposal (ITAD) is the discipline of getting rid of IT equipment safely. Because a retired device may still hold sensitive data, disposal is as much a security task as a logistics one.

In this guide, we’ll cover what ITAD includes, how to sanitize data properly, the rules that apply, how to choose a certified ITAD vendor, and a step-by-step disposal process that stands up to an audit.

What Is IT Asset Disposal (ITAD)?

IT asset disposal is everything that happens to a device once your organization decides it’s done with it. That includes decommissioning it, sanitizing or destroying its data, and then reusing, reselling, recycling or destroying the hardware. Documenting each step is part of the process too.

You’ll also see ITAD expanded as IT asset disposition. The terms are used interchangeably, though “disposition” hints at the goal: not only disposing of equipment, but recovering value from it where possible.

The aim is simple. No data should leave the building on a forgotten drive, and no device should be discarded in a way that creates legal or environmental liability.

ITAD vs. IT Asset Retirement and Recovery

These three terms describe neighboring stages of the same lifecycle.

• IT asset recovery gets equipment back, for example from a departing employee.
• IT asset retirement is the decision to take an asset out of active service, because it’s reached end of life, lost vendor support or is no longer needed.
• IT asset disposal is what happens next: making the data unrecoverable and removing the hardware from your possession responsibly.

Retirement is the trigger, and disposal is the action. This article focuses on disposal.

Why Secure IT Asset Disposal Matters

There are four reasons to treat disposal as a controlled process rather than a trip to the recycling bin.

• Data security. Files that are merely deleted, or drives that are only reformatted, can often still be recovered. A single resold laptop or discarded server drive can expose customer, employee or financial data.
• Compliance. Many regulations require sensitive data to be destroyed before media is reused or discarded, and auditors expect proof that it was.
• Environmental responsibility. Electronics contain hazardous materials and recoverable metals. They should be reused or recycled through responsible channels, not landfilled or exported to be dismantled unsafely.
• Value recovery. Working equipment can be redeployed internally or resold, which offsets the cost of a refresh.

Data Sanitization: Making Data Unrecoverable

Data sanitization is the heart of secure disposal. The reference most organizations follow is NIST Special Publication 800-88, Guidelines for Media Sanitization, whose second revision NIST published in September 2025. It defines three levels of sanitization.

Clear

Clearing uses standard read and write commands to overwrite the storage a user can reach, such as writing new data over every addressable location on a drive. It protects against simple, non-invasive recovery. It suits media that stays inside the organization, such as a laptop being reissued to another employee.

Purge

Purging uses techniques that protect against recovery even with laboratory methods. Examples include a drive’s built-in sanitize command, cryptographic erase (destroying the key that encrypted the data) and, for magnetic media, degaussing. Purging is the right level for media that will leave your control but stay usable, such as equipment going to resale.

Destroy

Destruction makes the media physically unusable through shredding, disintegration, pulverizing, melting or incineration. It’s the right choice for the most sensitive data, and for media that can’t be purged reliably, such as a failed drive.

Match the Method to the Media

The right method depends on the storage technology.

• Hard disk drives: Overwriting works well for clearing. Degaussing or shredding works for purging and destruction.
• Solid-state drives and flash storage: The drive spreads writes across spare blocks, so an overwrite may not reach every copy of the data. Use the drive’s sanitize or cryptographic erase command, or destroy it. Degaussing has no effect on flash memory.
• Phones and tablets: Modern devices encrypt storage by default, so a factory reset that discards the encryption key works as a cryptographic erase. Remove the device from your management tool and any activation lock first, or it can’t be reused.
• Removable media: USB drives, memory cards and backup tapes are easy to overlook. Inventory them and sanitize or destroy them like any other drive.

Verify and Certify

Sanitization isn’t complete until it’s verified. Check a sample, or every device for sensitive media, to confirm the data is gone. Then record the result: the device’s serial number, the method used, who performed it, when, and how it was verified. A certificate of sanitization or destruction for each device is the evidence an auditor will ask for.

Compliance and E-Waste Rules

Disposal sits where data protection law and environmental law meet. The rules that apply depend on your industry and location, so involve your legal team. A few common examples:

• Health data. HHS guidance on HIPAA and the disposal of protected health information expects covered entities to clear, purge or destroy electronic media before it’s reused or discarded.
• Consumer report data. The FTC’s Disposal Rule requires businesses that use consumer reports, including employers running background checks, to dispose of that information so it can’t be read or reconstructed.
• E-waste. In the EU, the WEEE Directive governs the collection and recycling of electrical and electronic equipment. In the US, many states have their own electronics recycling laws, and the EPA recommends certified electronics recyclers.

Whatever applies to you, the common thread is proof. You need records showing what happened to each device and its data.

Choosing a Certified ITAD Vendor

Most organizations hand disposal to a specialist vendor. The vendor’s certifications are the quickest way to judge whether it will handle your equipment properly.

Certifications to Look For

• R2v3, from Sustainable Electronics Recycling International (SERI), is a standard for responsible electronics reuse and recycling. It covers data security, traceability of materials downstream, and environmental and worker safety.
• e-Stewards, from the Basel Action Network, is a recycling standard known for its strict rules against exporting hazardous e-waste to developing countries and sending it to landfill.
• NAID AAA Certification, from i-SIGMA, focuses on secure data destruction. Certified providers pass announced and unannounced audits, and the certification states whether they’re approved for on-site or off-site work and which media they handle.

R2v3 and e-Stewards both require data on used electronics to be destroyed, according to the EPA. NAID AAA focuses on how well that destruction is done.

Questions to Ask

• Will you destroy data on-site at our premises, or transport devices to your facility? How are they secured in transit?
• Do you provide a certificate of sanitization or destruction for each device, by serial number?
• How do you maintain chain of custody from pickup to final disposition?
• Where do materials go after you, and how do you check your downstream partners?
• How do you share resale proceeds, and how do you report on what was reused, resold and recycled?
• What insurance do you carry if data is exposed while devices are in your care?

The IT Asset Disposal Process

A repeatable process makes disposal predictable and auditable. Here are the steps.

1. Identify and Inventory

Know exactly which assets are being disposed of, and what data they hold. Pull each device’s record from your asset register, including its serial number, last user and data classification. An up-to-date register is the foundation, and part of any broader IT asset management strategy.

2. Back Up What You Need

Before anything is erased, make sure the business data on the device has been saved or migrated. Once a device is sanitized, its data is gone for good.

3. Decommission and Disconnect

Remove the device from your network, your directory and your management tools. Revoke certificates and any access tied to it. If the device belonged to someone who left, make sure their accounts have been deprovisioned too.

4. Sanitize or Destroy the Data

Apply the sanitization level that fits the data and where the device is going: clear for internal reuse, purge for resale, destroy for the most sensitive media. Do it in-house or through your ITAD vendor.

5. Reuse, Resell or Recycle

Redeploy working equipment internally where it still has useful life. Resell what has market value through your vendor. Send the rest for certified recycling.

6. Document Everything

Keep a chain-of-custody log, certificates for each device, and the vendor’s final reports. Update the asset register so each device is marked as disposed, with the date and method.

7. Review the Process

Check a sample of disposals against their records from time to time, and review your vendor’s certifications each year. Certifications lapse, and downstream partners change.

Best Practices for Secure IT Asset Disposal

• Write a disposal policy. Define which sanitization level applies to which data and media, who approves disposal, and which records are kept.
• Don’t let equipment pile up. Devices waiting in a storeroom are easy to lose track of. Process them on a regular schedule.
• Secure the waiting area. Store devices awaiting disposal in a locked area with access logged.
• Encrypt devices from day one. Full-disk encryption makes cryptographic erase possible at the end of a device’s life, and protects data if a device goes missing on the way.
• Tie disposal to offboarding. Devices recovered from leavers should flow straight into the process. Our IT offboarding checklist covers getting them back, including from remote employees.
• Keep records for as long as your regulations require. Certificates are only useful if you can find them when an auditor asks.

Where ezOnboard Fits In

ezOnboard doesn’t wipe or dispose of hardware. It handles the account side of the same lifecycle.

ezOnboard connects your HR system to Active Directory, Entra ID and Exchange. When HR records a departure, it disables the person’s accounts, removes their group memberships, reclaims their Microsoft licenses and forwards their mail, on the timeline you set. By the time their laptop reaches the disposal queue, it’s no longer tied to an active account.

Every change is recorded, so your account records line up with your disposal records when an auditor asks how a leaver was handled.

Book a demo to see it with your own HR system.

Frequently Asked Questions

What is the difference between IT asset retirement and disposal?

Retirement takes an asset out of active service. Disposal sanitizes its data and removes the hardware from your possession by reuse, resale or recycling. Retirement is the trigger, and disposal is the action.

Is deleting files or reformatting a drive enough before disposal?

No. Deleted files and reformatted drives can often be recovered with ordinary tools. Drives must be cleared, purged or destroyed using methods that fit the media, such as a sanitize command or cryptographic erase for SSDs.

What is a certificate of destruction?

It’s a document from whoever sanitized or destroyed a device that records its serial number, the method used, the date and who did it. It’s your proof that the data was handled properly, and it’s what auditors expect to see.

Which certifications should an ITAD vendor have?

Look for R2v3 or e-Stewards for responsible recycling, and NAID AAA Certification for data destruction. Confirm that the certifications are current and cover the services and media you need.

Can disposed IT assets be resold?

Yes, once their data has been purged. Working equipment can be resold or redeployed to recover value, with recycling for devices at the end of their life.