If your business needs to dispose of IT equipment safely, hire a certified ITAD provider. They log every device, erase or destroy the data to NIST SP 800-88 Revision 2, track who has custody along the way, recycle or resell what’s left, and hand you a Certificate of Data Destruction when it’s done. Doing it yourself, or tossing it out, leaves gaps in the data and in the paperwork.
Why Not Just Toss It?
Every office has the closet. Old laptops, a server nobody wants to touch, a box of drives that might matter. Picture a 30-person firm clearing a storage room before a lease ends. Someone hauls the lot to the dumpster on a Friday afternoon, and it feels like the problem is solved.
It isn’t, and the research is uncomfortable reading.
- Data stays on devices. In 2017, NAID (the data destruction trade association, now part of i-SIGMA) examined more than 250 devices bought through public resale channels and found personally identifiable information on 40% of them, using only basic recovery methods. Additionally, a 2019 University of Hertfordshire study for Comparitech bought 200 used hard drives and found that 59% still held data from their previous owners. Only 26% had been properly wiped. And Blancco, a data erasure vendor, recovered data from 78% of 200 used drives it bought on eBay and Craigslist in 2016. Two of those sources sell or promote erasure, so weigh that, but the three studies point the same way.
- Breaches cost real money. IBM’s 2026 Cost of a Data Breach Report puts the global average at a record $4.99 million, and $11.5 million in the United States. Retired equipment is only one source of breaches, but it’s one you fully control.
- E-waste keeps piling up. The UN’s 2024 Global E-waste Monitor found the world generated 62 million tonnes in 2022, and less than a quarter (22.3%) was documented as properly collected and recycled.
Five Options Compared
Businesses tend to land on one of five approaches. Here’s how they stack up.
Option Data Security Paperwork Value Recovered Best For 1. Trash or curb None None None Nothing. Skip it 2. Wipe it yourself, then sell or donate Depends on your method and how careful you are Whatever you keep Some, often low A few low-risk personal devices 3. Retail or municipal e-waste drop-off Usually none, so wipe first Rarely None Gear with no data on it, like cables 4. A recycler without data security credentials Unclear Often none Rarely Low-risk equipment, if they document it 5. A certified ITAD provider Documented erasure or destruction to NIST SP 800-88 Certificate, chain of custody, reports Resale value is evaluated Any business with data on its equipment A few things worth saying about this table:
- Option 1 is illegal in many places. ERI counts 23 states plus D.C. with landfill or disposal bans on electronics, and some of those bans reach businesses too. Connecticut, for example, bans disposal by any person, including businesses. Rules vary by location, so check yours.
- Option 2 works less often than people think. Deleting files, formatting, and factory resets can all leave recoverable data behind. In Blancco’s study, a quick format was used on 40% of the drives, and it still left data that could be recovered. DIY destruction, like drilling or burning, is unsafe and incomplete.
- Options 3 and 4 solve the environmental half of the problem. They don’t solve the data half. Recycling recovers materials. It doesn’t prove anyone destroyed your data.
- Option 5 can include on-site destruction when sensitive media can’t leave your building. See our partner’s on-site services.
Our view: if the equipment ever held data, options 3 and 4 aren’t enough on their own.
How to Choose
- A few laptops, nothing regulated. A verified wipe is often enough, or use a provider that takes small lots. Think of a small studio retiring three laptops.
- Dozens or hundreds of devices. Use a certified provider, so you get serial-level tracking and documentation. Our ITAD best practices for small and medium-sized businesses include a starter policy.
- Servers and a data center. Pick a provider that can handle de-racking, logistics, and bulk volume. Our guide to data center equipment recycling covers what that looks like.
- Regulated data (healthcare, finance, government). You want documented chain of custody, certificates, and a provider who already knows your rules, so you aren’t teaching them HIPAA on the job.
- Tape and drives. Our guides to hard drive disposal and tape disposal cover those.
What a Secure Process Includes
- Inventory. Every device is recorded by serial number, along with make, model, condition, and location.
- Data destruction. The method fits the device and how sensitive the data is.
- Chain of custody. Every handoff is documented. DES’s chain of custody process is one example. See our secure shipping details.
- Documentation. You receive a Certificate of Data Destruction listing serial numbers, the method, the date, and the standard followed.
A full explaination is in What Happens When You Dispose of an IT Asset, and our guide to secure IT asset disposal goes deeper.
Which Method?
NIST published SP 800-88 Revision 2 on September 26, 2025, and withdrew Revision 1 the same day. It keeps three levels: Clear, Purge, and Destroy. In practice, that looks like this:
- Software erasure overwrites the data, so the device can be reused or resold.
- Degaussing uses a strong magnetic field to scramble data on magnetic media like hard drives and tape. It usually leaves the device unusable, but it doesn’t work on SSDs.
- Physical destruction shreds media into fragments too small to recover. It’s the right call for damaged drives and highly sensitive data.
The simple rule of thumb: if you plan to resell it, erase it. If the data would hurt to see leaked, shred it.
SSDs need extra care. Because of wear leveling and over-provisioning, overwriting alone doesn’t reliably sanitize flash storage, so use a verified cryptographic erase, the drive’s manufacturer sanitize command, or destroy the drive.
Rules That May Apply
Which rules apply depends on your industry, your data, and where you operate. A few common ones:
- HIPAA. The Security Rule requires policies for the final disposition of electronic protected health information and the media it’s stored on (45 CFR 164.310(d)(2)(i)). HHS’s disposal FAQs explain how clearing, purging, and destroying fit in.
- PCI DSS. Requirement 9.4.7 calls for destroying electronic media with cardholder data once it’s no longer needed for business or legal reasons, so the data can’t be reconstructed.
- The FTC Disposal Rule and the GLBA Safeguards Rule. The Disposal Rule treats selling, donating, or transferring computer equipment as disposal, and expects reasonable measures to destroy or erase consumer information on it. The Safeguards Rule requires secure disposal of customer information in any format, generally within two years of its last use, with exceptions.
- State data disposal laws. At least 35 states, counting D.C. and Puerto Rico, require businesses to destroy personal information or make it unreadable, according to a 2023 law firm tally.
- GDPR. This applies if you handle personal data of people in the EU. Article 83 allows fines up to €20 million or 4% of worldwide annual turnover for the most serious violations, and up to €10 million or 2% for others, including failures of security obligations.
Not sure which of these apply to you? Ask legal or compliance before you ship anything, not after.
Five Questions for Any Provider
A good provider answers these without hesitation:
- Which certifications do you hold, and can you show current documentation?
- How do you track each device from pickup to final disposition?
- Will I receive a Certificate of Data Destruction with serial numbers?
- How do you handle SSDs, tape, and network gear?
- Where does recycled material end up?
One more thing: ask to see a sample certificate before you sign. If they can’t produce one, keep looking. Our partner’s ITAD vendor checklist goes deeper, and you can see who we’ve worked with on our references page.
Get Value Back, and Recycle the Rest
Disposal doesn’t have to be a pure cost. We evaluate equipment before we process it, and we make an offer upfront when there’s resale potential.
The market is working in sellers’ favor right now. A benchmarking report covered by Resource Recycling found server resale values reached roughly 2.5 times their seven-year average in 2025. Memory is the clearest example. ITLDC estimates a 64 GB DDR4-2933 server module now costs roughly 2.5 to 3.2 times its January price, citing TrendForce’s estimate that conventional DRAM contract prices jumped 93 to 98 percent in the first quarter of 2026.
Here’s what we buy:
- Servers and data center lots
- Laptops
- Hard drives and storage
- Networking equipment
- Memory and tape
Equipment without resale value goes to responsible recycling through our partner DES Technologies, which is R2v3-certified. Go check out our electronics recycling services.
Frequently Asked Questions
What is the safest way to dispose of IT equipment?
Use a certified ITAD provider. They erase or destroy the data to NIST SP 800-88 Revision 2, track chain of custody, and give you a Certificate of Data Destruction.
Can I wipe devices myself and then recycle or sell them?
For a handful of low-risk devices, a careful wipe that you verify can work. For business equipment, DIY methods tend to miss data, and you won’t have the paperwork to show an auditor what happened.
Is it okay to take old equipment to a drop-off site?
If there’s no data on it, like cables, yes. If it ever stored data, wipe or destroy it first, because most drop-off sites don’t provide data destruction or documentation.
Do I need a Certificate of Data Destruction?
You should have one. It’s your proof that the data was properly destroyed. A strong certificate lists each device’s serial number, the method, the date, and the standard followed.
How do I dispose of SSDs securely?
Overwrite tools built for hard drives don’t reliably sanitize SSDs. Use a verified cryptographic or manufacturer secure erase, or destroy the drive.
Can I get paid for old IT equipment?
Often, yes. Servers, laptops, memory, drives, networking gear, and tape frequently have resale value. Get equipment evaluated before you recycle it, because scrapping first can mean scrapping something someone would have paid for.
What happens to equipment that can’t be resold?
It’s recycled, so metals, plastics, and components are recovered instead of landfilled. Look for R2v3-certified recycling and documentation showing where the materials end up.
Ready to Dispose of Your Equipment?
Get a free quote to see what your equipment is worth and how we’ll protect your data. The process is simple: send us your list, get a quote, and we cover shipping. Every device goes through our Phoenix Certified process, and you get paid with a Certificate of Data Destruction. Questions? Our FAQ covers most of them. For more on the risks, see our guide to data breach risk management.
