Best Practices for Asset Disposal

IT asset disposal sits at an awkward point in the hardware lifecycle. Devices are no longer anyone's priority, yet they still hold data, still carry a value and still fall under legal and environmental duties. Most disposal failures come from gaps in process rather than bad intentions: a laptop that missed the wipe queue, a box of drives with no paperwork, a collection nobody signed for.

These best practices help you address data risk, policy requirements, chain of custody and record-keeping in one joined-up process.

What are the best practices for IT asset disposal?

Write a disposal policy, keep an accurate asset register, secure devices as soon as they are retired, sanitise with methods suited to each media type, verify results, maintain chain of custody and keep per-device records. Prefer reuse where it is safe.

1. Write a disposal policy before you need it

A short, clear policy prevents improvised decisions. It should state which device types are covered, who can authorise disposal, the sanitisation standard required for each data category, approved destinations (redeployment, resale, donation, recycling or destruction), and how long records are kept. Reference recognised guidance such as NIST SP 800-88 Rev. 2 and IEEE Std 2883-2022 for methods, and NCSC guidance for UK public sector or OFFICIAL data.

2. Keep an accurate asset register

You cannot dispose of something securely if you do not know it exists. Track every device, and ideally every drive, from purchase to final destination. At retirement, record the asset tag, serial numbers, last user, data sensitivity and intended destination. NIST SP 800-88 Rev. 2 notes that tracking equipment from arrival to final destination is what makes sanitisation records meaningful.

3. Secure devices as soon as they are retired

The period between retirement and erasure is a common weak point. Store retired equipment in a locked, access-controlled area, keep a log of what goes in and out, and set a target time for erasure so devices do not accumulate.

4. Match the sanitisation method to the media and destination

NIST and IEEE describe three levels of sanitisation: Clear, Purge and Destroy (IEEE uses Destruct). Clear protects against simple recovery through the normal interface; Purge makes recovery infeasible even with laboratory techniques while leaving the media reusable; Destroy leaves the media unable to store data. NIST recommends Purge over Clear where possible, and it is the usual target for devices leaving your control intact.

The technique must also suit the storage. Overwriting works for magnetic hard drives. SSDs need drive-supported sanitise commands or cryptographic erase, because wear levelling means simple overwriting cannot reach every cell. See secure data erasure methods for a comparison.

5. Prefer erasure and reuse where it is safe

Physical destruction is right for failed, unsupported or extremely sensitive media, but it removes all reuse value and adds to electronic waste. IEEE 2883.1-2025 encourages reuse where sanitisation allows it. Properly purged devices can be redeployed or sold, recovering value and reducing environmental impact. Our comparison of data wiping versus physical destruction covers the trade-offs.

Where destruction is needed, do it properly. NIST notes that drilling or bending a drive leaves parts of the platters or chips intact and potentially recoverable. NCSC guidance for OFFICIAL data calls for particles of 6 mm or less, with erasure first where possible.

6. Verify, validate and handle exceptions

Confirm that each erasure completed without errors and that the method suited the media. NIST SP 800-88 Rev. 2 calls the decision to accept or reject a result "validation". Any drive that fails should go into a controlled exception route: retry, escalate to a stronger method, or destroy. Never let a failed device move on with the successful ones. Our guide to verifying hard drive wiping explains how.

7. Maintain chain of custody

Every handover is a point where a device can go missing. Record who held each device, when it moved and where it went. If a third party collects or processes equipment, get signed collection records that list serial numbers, and make sure your contract covers data handling. Under UK GDPR, a provider that handles personal data on your behalf is a processor and needs a written contract.

8. Keep records you can actually use

NIST recommends a certificate of sanitisation for each item, recording the media details, method, technique, tool and version, verification and the people responsible. Keep these records with the asset entry for the period your policy requires. A recycler's certificate shows what the recycler did; it does not prove your organisation erased the data before handover. See asset disposal documentation for what a good record contains.

9. Meet environmental obligations

In the UK, the Waste Electrical and Electronic Equipment (WEEE) Regulations govern how electrical equipment is disposed of. Use licensed recyclers or take-back schemes, and keep their waste transfer documentation alongside your data records.

10. Audit the process

Periodically pick a sample of disposed assets and trace them end to end: register entry, erasure record, custody trail and final destination. Gaps found in an internal review are far cheaper than gaps found after an incident.

Tools that make good practice easier

A consistent erasure tool reduces variation between technicians. RedKey USB, our bootable erasure tool, boots supported PCs and Intel Macs outside the installed operating system and erases the drives it detects, with unlimited use from a one-time purchase. The Professional and Ultimate editions generate a PDF report for each erasure to support your records; the Home edition shows the result on screen. The Ultimate edition also erases supported iPhone, iPad and Android devices.

Good asset disposal is not complicated, but it does need to be deliberate. A written policy, a reliable register, the right method and complete records will cover most of the risk.

Frequently asked questions

What should an IT asset disposal policy cover?

Scope, authorisation, the sanitisation standard per data category, approved destinations, chain of custody, records and retention periods.

How do you dispose of employee devices?

Through the same controlled process: record, sanitise, verify, record and send to an approved destination.

RedKey USB Professional produces a PDF report for each erasure to support your disposal records. Related reading: Asset Disposal Documentation That Stands Up and IT Asset Disposition Checklist That Holds Up.