When you dispose of an IT asset, a secure ITAD provider inventories it, erases or destroys the data to NIST SP 800-88 Revision 2, tests and grades the equipment, and then resells, refurbishes, or recycles it. You should receive a Certificate of Data Destruction with serial numbers. Without that process, data can leak and equipment can end up in a landfill.
See the full service: Our IT asset disposition services cover every step below, and our partner’s ITAD hub goes deeper.
In this guide: When to dispose · The six steps · What happens if you skip it · What not to do · What it’s worth · A checklist · FAQ
When Is It Time to Dispose of an IT Asset?
An IT asset is any equipment or software your organization uses to process, store, or move information, from servers and laptops to drives, network gear, and tape. It’s time to retire one when:
- The vendor has stopped supporting it. No more security patches is the clearest signal. For example, Microsoft’s final paid security updates for Windows Server 2012 R2 ended on October 13, 2026.
- It can’t be repaired or upgraded at a reasonable cost.
- It’s costing more than it’s worth in maintenance, power, or risk.
- Nobody uses it, and it’s taking up space.
Warranty expiration alone isn’t the trigger. Plenty of equipment keeps working, and keeps its value, past its warranty.
The Six Steps: Follow One Device From Your Office to Its Final Destination
Step 1: Inventory and Pickup
Everything starts with a list. Each device gets recorded by serial number and tagged. Then it’s packed securely, sealed, and tracked while it travels, so there’s a record of who handled it and when. That record is the start of your chain of custody. See our secure shipping details and DES’s chain of custody process.
Step 2: Intake and Verification
When equipment arrives, it’s checked against your list. Serial numbers should match. Anything missing or extra gets flagged right away. This catches problems before data leaves the chain of custody unnoticed.
Step 3: Data Sanitization
This is the step that protects you. The method depends on the device and how sensitive the data is. NIST’s current guidance, SP 800-88 Revision 2 (published September 2025), describes three levels:
- Clear. Software overwrites the data, and the device stays usable. Often used for equipment you plan to resell.
- Purge. For magnetic media, this usually means degaussing. It typically leaves the device unusable.
- Destroy. Physical destruction, such as shredding. It’s the right choice for damaged drives and highly sensitive data.
Two cautions. Overwrite tools built for hard drives don’t reliably sanitize SSDs, so flash drives need a verified cryptographic or manufacturer secure erase, or destruction. And a drive that no longer works usually can’t be overwritten at all, so it gets destroyed. See DES’s data erasure process, and our data sanitization guide.
Step 4: Testing and Grading
Once the data is gone, equipment gets tested and graded. Working, in-demand gear heads toward resale or refurbishment. Parts may be pulled for reuse. Anything without value moves to recycling. This is the step where value is found, which is why we evaluate before we process.
Step 5: Resale, Refurbishment, or Recycling
Equipment with value is resold or refurbished. Everything else goes to responsible recycling, where metals, plastics, and components are separated and recovered instead of landfilled. Look for R2v3-certified recycling, such as DES’s R2v3 certification, and see our electronics recycling services.
Step 6: Reporting and Payment
You get proof. A solid Certificate of Data Destruction lists each device’s serial number, the method used, the date, and the standard followed. You also get chain-of-custody records and, if your equipment had value, payment. This paperwork protects you if a regulator, auditor, insurer, or customer ever asks what happened to your data.
How It Works With Us
- Send us your list. Include equipment type, quantity, and condition.
- Get a quote. We review your list and send an offer.
- We cover shipping. We handle labels and logistics.
- We erase or destroy the data through our Phoenix Certified process.
- You get paid, with documentation. A Certificate of Data Destruction comes with your payment.
What Happens if You Skip the Process
Data exposure. IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million, and $10.22 million in the United States. Studies of resold drives keep finding recoverable data. A 2019 University of Hertfordshire study commissioned by Comparitech found that 59% of 200 used drives had not been properly wiped, and a 2016 Blancco study found data on 78%.
Legal trouble. Many states restrict or ban putting electronics in the trash, and businesses are often held to stricter rules than households. Rules vary by location, so check yours.
Environmental harm. Electronics contain materials that shouldn’t end up in landfills. The UN’s 2024 Global E-waste Monitor found that the world generated 62 million tonnes of e-waste in 2022, and only 22.3% was documented as properly collected and recycled.
Lost value. Equipment sitting in a closet keeps depreciating.
What Not to Do
- Don’t toss equipment in the trash or leave it on the curb. It’s illegal in many places, and data can leak.
- Don’t burn drives or drill holes in them. Burning electronics releases toxic fumes, and drilling can leave data recoverable. Use certified shredding instead.
- Don’t rely on deleting files, formatting, or a factory reset. They can leave recoverable data behind.
- Don’t sell equipment informally without a verified wipe. Selling used equipment is fine when the data is properly sanitized first. Informal sales add data and fraud risk, and they often bring lower prices.
- Don’t hand equipment to a recycler who can’t give you paperwork. No certificate, no proof.
- Don’t skip documentation. If you can’t prove it, it didn’t happen.
What Is It Worth?
Often, more than people expect. Servers, laptops, networking gear, storage, memory, and tape frequently have resale value. According to recent market reports, server memory prices roughly doubled this year, and industry benchmarks show server resale values running well above their long-term averages. Check what we buy:
A Quick Checklist
- List every device by serial number
- Check retention rules and legal holds
- Choose a method that fits each device
- Use a provider with certifications and chain of custody
- Get a Certificate of Data Destruction with serial numbers
- Keep the paperwork
For a fuller process, see our guides to secure IT asset disposal, ITAD best practices for small and medium-sized businesses, and IT asset management. Choosing a provider? Our partner’s vendor checklist shows what to verify. For drives specifically, read our hard drive disposal guide.
Frequently Asked Questions
What happens to IT equipment when you dispose of it?
A secure ITAD provider inventories it, erases or destroys the data, tests and grades it, and then resells, refurbishes, or recycles it. You should receive a Certificate of Data Destruction.
What happens to the data on my old devices?
It’s either overwritten, degaussed, or destroyed, depending on the device and how sensitive the data is, following NIST SP 800-88 Revision 2. A factory reset isn’t enough.
Is it safe to throw old IT equipment in the trash?
No. It’s illegal in many places, and data can be recovered from discarded drives. Use a certified ITAD provider.
How do I know my data was destroyed?
Ask for a Certificate of Data Destruction listing each device’s serial number, the method, the date, and the standard followed, plus chain-of-custody records.
Can I get paid for old IT equipment?
Often, yes. Servers, laptops, memory, drives, networking gear, and tape frequently have resale value. Get equipment evaluated before you recycle it.
What’s the difference between recycling and secure disposal?
Recycling recovers materials. Secure disposal covers the whole process, including destroying data first and documenting that it happened.
Can I dispose of IT assets myself?
You can, but it’s hard to do securely. DIY methods can miss data or create safety hazards, and you won’t have the paperwork to prove what happened. A certified provider handles it with documentation.
Ready to Retire Your Equipment?
Get a free quote to see what your equipment is worth, and how we’ll protect your data. See who we’ve worked with on our references page, read our FAQ, or return to our IT asset disposition services for the full picture.
