Why follow a defined process?
An ad hoc approach to retiring IT equipment — storing old machines, passing them to staff or sending them to a general waste contractor — creates legal exposure and missed value recovery. A defined IT asset disposal process addresses both problems. It protects your organisation by generating evidence of compliance, and it captures the residual financial or social value in equipment before it is destroyed.
The process described here reflects established ITAD practice in the UK. For background on the service as a whole, read our guide on what ITAD is and how it works.
Stage 1: Scope and planning
Before any equipment moves, both your team and your ITAD provider need a clear picture of what is being disposed of.
This stage involves:
- Producing an inventory of all devices in scope — make, model, serial number, location
- Identifying any devices with special data sensitivity (HR systems, finance servers, medical records)
- Agreeing a collection schedule that minimises disruption to operations
- Confirming the data destruction method required for each device type
If your organisation lacks an up-to-date IT asset register, your provider can help with on-site auditing. Our IT asset disposal checklist gives you a starting framework for the planning stage.
Stage 2: Collection and chain of custody
Equipment is collected from your premises by a licensed waste carrier. At the point of collection, a chain-of-custody document is created. This records:
- Every device collected, by serial number
- The date, time and location of collection
- The identity of the operatives handling the equipment
- Your signature as the transferring party
This document is the beginning of your audit trail. Under the Environmental Protection Act 1990, you have a duty of care to ensure your waste is handled lawfully from this point — the waste transfer note issued at collection is evidence that you discharged that duty.
Stage 3: Intake and asset logging
At the ITAD facility, every device is logged against the collection manifest. Any discrepancies between what was collected and what arrived are flagged immediately. Each item receives a unique tracking reference that follows it through every subsequent stage.
Devices are assessed for physical condition and categorised:
| Category | Condition | Next stage |
|---|---|---|
| A | Fully functional, minimal wear | Wiping, then remarketing or donation |
| B | Functional, cosmetic damage | Wiping, refurbishment, then resale |
| C | Faulty or end-of-life | Data destruction, then recycling |
| D | Physically damaged, unbootable | Physical destruction of storage media |
Stage 4: Data destruction
This is the most legally critical stage. Every device that has held data — whether it is being remarketed or recycled — must have its storage media securely destroyed before it leaves the ITAD provider’s control.
Two principal methods are used:
Software overwriting. Bootable devices have their storage overwritten using a certified tool to NIST 800-88 or HMG Infosec Standard 5 (the UK government’s data sanitisation standard). Multiple overwrite passes render data unrecoverable to forensic tools. A software certificate is generated per device.
Physical destruction. Drives that cannot boot, solid-state drives from certain device categories, and any drives specified by the client as requiring physical destruction are shredded or degaussed. This method is irreversible and produces a destruction certificate.
Under UK GDPR and the Data Protection Act 2018, you need to be able to demonstrate that personal data was destroyed — these certificates are your evidence. The ICO expects organisations to hold documentation of their disposal processes.
Stage 5: Grading and value recovery
Devices that have been wiped and confirmed data-free are graded for resale or donation. Functional devices in grade A or B condition are refurbished where needed — replacement batteries, screen repairs, operating system reinstallation — and then:
- Listed for resale on secondary markets, with any proceeds shared with the client under agreed terms, or
- Donated to community partners such as digitally-excluded households and social enterprises
Recycle4Charity’s model channels refurbished devices to Londoners who lack access to technology, giving your old equipment a second life in the local community.
Stage 6: WEEE-compliant recycling
Devices that are not suitable for reuse proceed to recycling. The WEEE Regulations 2013 require that waste electrical and electronic equipment is processed at an authorised treatment facility (AATF). At the facility, equipment is dismantled and sorted into material streams — ferrous metals, non-ferrous metals, plastics, glass and circuit board material — each of which is processed by specialist downstream recyclers.
No WEEE should enter general landfill. Your provider issues a waste transfer note confirming the recycling route.
Stage 7: Certification and reporting
At the conclusion of the project, your ITAD provider issues a final report covering:
- A device-level asset manifest listing every item processed
- Data destruction certificates (one per device, specifying method and standard)
- Waste transfer notes for all WEEE recycling
- Details of any remarketing or donation outcomes
- Any financial credits due from asset recovery
This pack is your compliance documentation. Keep it for the duration required by your data retention policy — the ICO recommends retaining records that demonstrate compliance for as long as the obligation exists.
To begin planning your next disposal project, visit our business services page or use the checklist in our companion article to prepare your inventory.