IT asset disposal is what you do with a company laptop, phone or monitor once it's no longer in use: record that it's leaving, back up anything you need, sign it out of every account, wipe it, and then resell, donate, recycle or return it, keeping proof of what happened. For a small business without an IT department, that's an afternoon's work per batch, not a project.
The step people skip is the wipe. In a 2019 study, Blancco and Ontrack bought 159 second-hand drives on eBay in the US, UK, Germany and Finland and found sensitive data on 42% of them, even though every seller said the drives had been erased (Blancco, 2019). This guide covers how to avoid being one of those sellers, plus the UK and US rules at a level a non-specialist can act on.
What does IT asset disposition (ITAD) mean?
IT asset disposition, usually shortened to ITAD, means retiring IT equipment in a way that's secure and legal: the data is destroyed, the hardware goes to reuse or proper recycling, and there's a record of both. "IT asset disposal" means the same thing in practice. ITAD is also the name for the specialist companies that do this for a fee.
Enterprise guides describe ITAD as a programme with chain-of-custody forms, audited vendors and asset recovery targets. A team of 15 people retiring six laptops a year doesn't need most of that. You need three things to be true when a device leaves:
- No company or personal data can be recovered from it.
- It went somewhere legitimate: a buyer, a charity, a registered recycler or the leasing company.
- Your records show what happened to it and when.
Everything below is about getting those three right with the tools you already have.
When should you retire a company laptop, phone or monitor?
Retire a device when it costs more to keep than to replace, when it stops getting security updates, or when it's broken beyond a sensible repair. For most small teams that means laptops at three to five years, phones at two to three, and monitors when they fail rather than on a schedule.
Common triggers:
- Security updates have ended. A laptop or phone that no longer gets operating system updates shouldn't hold company data.
- The repair costs more than half a replacement. At that point the money is better spent on a new device.
- The warranty has expired and it's slowing people down. That's a good moment to plan the replacement before it fails.
- A leaver's device isn't worth reissuing. If it comes back from offboarding with a tired battery, it may be cheaper to retire than to refurbish.
- A lease is ending. Leased kit goes back on the lessor's timetable, not yours.
Our post on laptop refresh cycles goes into the budgeting side of this. Retiring in batches, once or twice a year, is easier than doing it one device at a time.
What is the IT asset disposal process, step by step?
The IT asset disposal process for a small business has eight steps: record it, back up, sign out and release it, wipe it, remove tags, choose where it goes, get proof, and close the record. Do them in that order. Wiping before backing up loses data, and wiping before signing out can lock the next owner out of the device.
1. Record that it's being retired
Find the device in your asset register and note the serial number, who last had it, and why it's being retired. If it isn't in the register, add it now. You can't prove a device was wiped if you can't say which device it was.
2. Back up what you need
Check whether anything on the device exists nowhere else: local files, a design archive, an authenticator app. If the device came back from a leaver, check with their manager before wiping. Most teams keep work in cloud storage now, so this is often a two-minute check, but it's the only step you can't undo.
3. Sign out of accounts and release it from management
Sign the device out of the user's Apple, Google or Microsoft account, and out of company apps. On iPhones and Macs, signing out of iCloud turns off Find My, which otherwise blocks the next owner from setting it up. On Android, remove the Google account first. Google's reset guide says the phone asks for that account's details after a reset, which leaves the next owner stuck.
If you use mobile device management (MDM) such as Jamf, Kandji or Intune, or Apple Business Manager, remove or release the device there too. Otherwise it may re-enrol itself into your company setup when the buyer switches it on.
4. Wipe it properly
Use the built-in erase, not a manual delete or a quick format. Emptying the bin and reformatting don't securely delete data, as the ICO's guidance on deleting data from devices points out. The official guides:
- Mac: Apple's before you sell, give away or recycle your Mac. Macs with Apple silicon or a T2 chip on macOS Monterey or later can use Erase All Content and Settings.
- iPhone and iPad: Apple's before you sell, give away or trade in your iPhone or iPad, which ends with Erase All Content and Settings.
- Windows: Microsoft's Reset your PC. Choose Remove everything and turn on the option to clean the drive, which Microsoft recommends if you're selling, donating or recycling.
- Android: Google's reset your Android device to factory settings, plus your phone maker's own instructions.
Monitors, keyboards and docks don't hold data, so they skip this step. Printers and some network kit can store scanned documents or settings, so check the manufacturer's reset instructions for those. If a device won't turn on, you can't wipe it, so either have the drive removed and physically destroyed or hand it to a disposal company that will do that and certify it.
If you want the technical standard behind all this, it's NIST's SP 800-88 Rev. 2, Guidelines for Media Sanitization, updated in September 2025.
5. Remove asset tags and labels
Peel off your asset tag, QR label and anything with the company name on it. A tag on a resold laptop points back to you, and if you reuse tag numbers it can confuse a later audit. Keep the tag number on the record, though.
6. Decide where it goes
Resell, donate, recycle, or return it to the leasing company. The table in the next section compares them.
7. Get proof
Keep the sale receipt, the charity's acknowledgement, the recycler's waste transfer note, or the disposal company's certificate of data destruction. More on certificates below.
8. Close the record
Mark the asset as retired, with the date, method and where it went. Don't delete the record. You'll want it for your accounts, for insurance, and the next time someone asks "didn't we have a second MacBook Pro?"
Should you resell, donate or recycle old IT equipment?
Resell devices that still work and have value, donate working kit that's too old to sell well, recycle anything broken or worthless, and return leased kit to the lessor. Whatever you choose, wipe the device first. The destination changes the paperwork, not whether data has to go.
| Option | Best for | What you get back | Proof to keep |
|---|---|---|---|
| Resell or trade in | Working laptops and phones a few years old | Cash or credit against new kit | Sale receipt or trade-in confirmation, plus your own wipe record |
| Sell to the employee | A leaver or long-serving staff member who wants their old laptop | A small payment, and goodwill | A short written sale note with the serial number and price |
| Donate | Working kit too old to sell for much | Nothing financial, but it gets reused | The charity's acknowledgement, plus your wipe record |
| Recycle | Broken devices, old monitors, cables and peripherals | Usually nothing, sometimes a collection fee | Waste transfer note (UK) or recycling receipt, and a data destruction certificate if drives went with it |
| Return to lessor | Leased or rented equipment | The end of the lease payments | The lessor's return receipt. Check your contract for who does the wipe |
| ITAD company | Larger batches, dead devices you can't wipe, or regulated data | Sometimes a share of resale value, sometimes a fee | Certificate of data destruction listing each serial number |
Recycling properly is worth the extra step. The UN's Global E-waste Monitor found that the world generated a record 62 million tonnes of e-waste in 2022, and less than a quarter of it (22.3%) was documented as properly collected and recycled (ITU and UNITAR, 2024).
Do you need a certificate of data destruction?
You need a certificate of data destruction when someone else handles the wiping or destruction for you, such as an ITAD company or a recycler that takes devices with drives still inside. If you wiped the device yourself, your own record of the date, method and serial number is the evidence.
The UK regulator expects this. The ICO's audit toolkit for disposal says organisations should obtain evidence of secure disposal from third parties, and suggests that someone checks the destruction certificates match what was sent (ICO, disposal and deletion toolkit).
A useful certificate lists each device by serial number, the method used (wiped or physically destroyed), the date, and who did it. A certificate that just says "12 laptops" won't help you if one of them turns up on a marketplace with your data on it. Store the PDF with the asset records it covers.
What are the rules for IT asset disposal in the UK?
In the UK, two sets of rules apply: waste rules for the hardware and data protection rules for whatever is stored on it. The WEEE Regulations and your waste duty of care cover where the equipment goes, and UK GDPR covers making sure personal data on it can't be recovered.
WEEE. Under the WEEE Regulations 2013, producers have to finance the collection and recycling of business (non-household) electrical equipment they put on the market from 13 August 2005. For older equipment, the producer of a like-for-like replacement has to cover it (regulation 12). In practice, ask the supplier or manufacturer of your new kit about take-back before paying a recycler. Producers can agree other arrangements with business customers, so check your purchase terms.
Duty of care. If the equipment goes as waste, use a registered waste carrier and complete a waste transfer note for each load, keeping a copy for two years (GOV.UK, waste transfer notes). Don't put electronics in general office waste.
UK GDPR. Laptops and phones almost always hold personal data: emails, customer files, HR documents. The ICO links secure disposal to the security principle in Article 5(1)(f) and Article 32 of UK GDPR. If you use a disposal company, it's handling that data on your behalf, so you can still be responsible if it gets it wrong. Choose one that will give you per-device certificates.
The gap the ICO is worried about is real: in a December 2024 survey for the ICO, 29% of UK adults said they didn't know how to wipe personal data from an old device (ICO, 2024). Don't leave the wipe to the person who used the laptop.
What about the US and the EU?
In the US, there's no single federal rule for business e-waste. Twenty-five states plus the District of Columbia have their own electronics recycling laws (US EPA), and what each covers, including whether it applies to business equipment, varies. The ERCC's state law map is the quickest way to check yours. Data rules depend on your sector too, so a health or finance business may have extra requirements.
In the EU, the WEEE Directive (2012/19/EU) sets the recycling framework that each country implements, and GDPR's security obligations apply to personal data on old devices in the same way as UK GDPR. Wherever you are, the safe default is the same: wipe it, send it somewhere legitimate, and keep the paperwork.
This is general guidance, not legal advice. If you handle sensitive regulated data, check with an adviser or a certified ITAD provider.
IT asset disposal checklist
Print this or copy it into your own process doc. Run it for each device, or for each batch.
- Record the device as being retired, with serial number, last user and reason.
- Back up anything that only exists on the device.
- Sign out of Apple, Google and Microsoft accounts and company apps.
- Release it from MDM or Apple Business Manager if you use them.
- Wipe it with the built-in erase (clean the drive on Windows).
- Check it boots to a setup screen with no accounts.
- Remove asset tags, QR labels and company stickers.
- Choose the destination: resell, sell to employee, donate, recycle, return to lessor or ITAD company.
- Collect proof: receipt, acknowledgement, waste transfer note or certificate of data destruction.
- Update the record: status retired, date, method, destination, and attach the proof.
If the device is coming back from a leaver, our offboarding checklist covers getting it back first. An equipment audit once a year will also catch devices that were disposed of but never marked as such.
How do you keep track of retired equipment?
Keep retired devices in your asset register with a retired status instead of deleting them. The record of what you owned, what it cost and where it went is what your accountant, your insurer and your next audit will ask for.
In AssetJay, you set an asset's status to Retired, add the date and destination in its notes, and attach the sale receipt or destruction certificate as a PDF on the asset's record. Retired items drop out of warranty reminders but stay searchable. It doesn't wipe or lock devices remotely, so pair it with your device's built-in erase or an MDM for that part. For the wider picture of tracking kit from purchase to disposal, see our guide to IT asset management for small businesses.
