Chain of Custody for Devices: 7 Controls That Matter

A chain of custody for devices is not a spreadsheet put together after a laptop goes missing. It is a documented, repeatable process that shows where an asset was, who handled it, what happened to its data and when it left your organisation's responsibility. When devices hold customer records, staff details, financial data or health information, that evidence matters as much as the hardware itself.

For IT teams, managed service providers and refurbishers, the aim is simple: no untracked devices, no unrecorded handovers and no doubt about whether data was securely erased before a device is reused, sold or disposed of.

Why chain of custody for devices matters

A retired device can create risk at several points. It may sit in an unlocked storeroom after a member of staff leaves. It may go to a recycler without a complete asset list. It may be sold or redeployed before anyone checks that its data was erased. Any one of these gaps can turn a routine hardware refresh into a reportable incident, an audit finding or a contractual problem.

A chain of custody gives you the evidence to show your process works. It links a specific asset to a specific sequence of events: collection, storage, transport, data erasure, disposal and final closure. If a compliance lead, customer, regulator or internal auditor asks what happened to a device, the answer should come from records, not memory.

This is especially relevant for organisations working under UK GDPR, contractual security obligations or internal data retention policies. These rules do not all prescribe the same custody form, but they consistently expect organisations to protect personal and sensitive information and to show that they have taken appropriate measures. A documented process turns that expectation into a working routine.

The seven controls that create a reliable record

1. Start with a complete asset identity

Every device entering the retirement process needs a unique identity you can check. Record the asset tag, serial number, make and model, device type, assigned user or department and current status. For phones and tablets, note the IMEI or other relevant identifier. For drives removed from a computer, record each drive separately from the chassis.

Asset identity is the foundation of the whole record. If an erasure report cannot be matched to the right serial number, it tells you little about that device. The same applies to shipping manifests, recycler receipts and internal transfer logs.

2. Record the first handover straight away

The first handover is where many custody gaps begin. Someone leaves a laptop at the help desk, a manager gathers devices after an office move, or a technician collects hardware during a refresh. The asset has changed hands, but nobody writes it down.

Create a collection record at the point of receipt. It should name the person handing over the device and the person accepting it, with the date and time, the device identifier and its condition. If the device is damaged, missing accessories, encrypted or unable to start, note that before anything else happens to it.

A signature helps when the risk or volume justifies it, but accountability does not depend on paper forms. A controlled digital workflow can work better if it keeps a time-stamped record that cannot be edited and limits who can change it.

3. Keep devices secure while they wait

Not every device can be erased on the day it is collected, so interim storage is a core part of the chain of custody rather than an admin detail. Keep devices in a restricted area that only authorised staff can enter. Use locked cabinets, cages or rooms depending on how many devices you handle and how sensitive they are.

The right level of control depends on the setting. A small business handling a few laptops a month may only need a locked IT cabinet and a sign-in sheet. A hospital, bank or high-volume refurbisher may need access logs, camera coverage, separate storage zones and regular stock checks.

What matters is that you can show who had access and that devices were protected from loss, theft or removal until their data had been erased.

4. Control every internal and external handover

A device does not leave your custody just because it leaves the IT department. Transfers to another office, a repairer, a staging area or a disposal partner all need recording. Note the sender, receiver, date, transport method, number of assets and identifying details for each device.

For larger shipments, use a manifest that is checked at both ends. The receiver should confirm that the device count and serial numbers match the outgoing list. Investigate any mismatch straight away rather than adding it to a future tidy-up list.

Outside suppliers add another layer of responsibility. Their process may be strong, but your organisation is still responsible for choosing them, overseeing the work and keeping records. Review contracts, security procedures, insurance, any onward use of subcontractors and the evidence the supplier sends back after processing.

5. Erase the data and keep the report

Holding a device does not prove its data is protected. The key custody event is secure erasure of the data, checked and recorded, before a device is redeployed, sold, donated, recycled or otherwise released.

Use an erasure method that suits the type of storage and the condition of the device. A working hard drive can be securely erased and checked. A failed drive may need physical destruction because software cannot complete the erasure. SSDs, self-encrypting drives, phones and removable media may each need different methods and checks.

The process should produce a report for each device that you can tie back to its asset record. At a minimum it should identify the disk, the erasure method and the result, and your own log can add the date, the person who carried out the work and the asset tag. A general note that a batch was wiped is weaker evidence than a report for each device.

Redkey USB gives teams a repeatable, USB-based way to erase computers and laptops. Each Redkey is a one-time purchase with unlimited use and no subscription. Redkey Professional and Ultimate create detailed PDF reports showing the disk, erasure method and result, while Redkey Home shows the result on screen only. Ultimate also adds erasure for supported Apple and Android mobile devices. The real benefit is not just speed. It is being able to link a completed erasure result to the asset record that entered your custody.

6. Deal with exceptions openly

A reliable process accepts that exceptions happen. A device may be missing from a collection list. A drive may fail during erasure. A serial number may be unreadable. A shipment may arrive with the wrong count. None of these is a reason to abandon the process. They are the reason it exists.

Set out an exceptions procedure with a named owner, investigation steps, deadlines and clear points for escalation. Mark the device status clearly as pending, failed, quarantined or physically destroyed. Never let an unresolved device move automatically into resale or disposal stock.

Exception records also show where your process is weak. If devices often arrive without asset tags, the problem may lie in day-to-day inventory management. If erasures fail often, the drives may be reaching the end of their life before the refresh. If manifests do not match, transport and receiving checks need attention.

7. Close the record only after final disposal

The final custody record should show the outcome for every device. Was it erased and redeployed? Was it erased and sold? Was the drive physically destroyed? Was the device passed to a recycler? Attach or reference the supporting evidence, such as erasure reports, destruction records, shipping paperwork and sale records where relevant.

How long you keep records depends on legal requirements, contract terms, legal holds and internal policy. Keep them long enough to answer future questions about a device, particularly when it held personal or confidential information. Make the records searchable by serial number, asset tag, member of staff, date range and final status.

Make the process work at scale

The best procedure is one technicians can follow on a normal busy day. If custody forms need the same details typed in again and again, or a manager has to approve every routine transfer, people will find ways around the process. Build the controls into the way you already collect, store, erase and dispose of devices.

Standardise status labels. Capture a scan or serial number at every handover. Keep devices waiting for erasure apart from those cleared for release. Check stock against records on a fixed schedule. Most importantly, make data erasure a required step before release, not a task that happens after a buyer or recycler has already been lined up.

Training should focus on the decisions people actually make. Help desk staff need to know when an accepted device becomes their responsibility. Technicians need to know which failed erasures mean a device must be quarantined. Purchasing and facilities teams need to know that surplus hardware cannot leave through informal routes. Clear ownership stops custody from becoming everyone's job and no one's responsibility.

A complete chain of custody does more than satisfy an auditor. It lets your team move hardware on quickly because every device has a known owner, status, erasure result and final destination. That is how device retirement becomes a controlled business process rather than a last-minute risk.