Free IT Asset Disposal and E-Waste Policy Template and Generator

This policy sets how [Company Name] (the "company") tracks its IT equipment and retires it at the end of its life: removing the data stored on it, reusing or recycling it responsibly, and keeping records that prove each step.

Why it matters. Old computers, phones, copiers, and drives often still hold customer, employee, and financial information long after they stop being used. Electronic equipment also contains materials that must be recycled properly, and North Carolina has banned computer equipment and televisions from landfills since July 1, 2011.

The policy is designed to follow NIST SP 800-88 Rev. 2 and EPA guidance on certified electronics recyclers, and to support the company in meeting its legal, regulatory, insurance, and contractual obligations. It does not replace those obligations. Where a law, regulation, or contract sets a stricter requirement, the stricter requirement applies.

This policy applies to all personnel of [Company Name] and to the following equipment owned or leased by the company, wherever it is located:

• Laptops, desktops, and workstations.
• Servers, storage systems, and backup appliances, and the drives inside them.
• Company phones and tablets.
• Printers, copiers, scanners, and fax machines that contain hard drives or memory, including leased units returned at the end of a lease.
• Firewalls, switches, routers, wireless access points, and security cameras and recorders.
• USB drives, external hard drives, memory cards, optical discs, and backup tapes.

It covers equipment that is retired, replaced, broken, returned under warranty or at the end of a lease, sold, donated, or lost or stolen. Company data on personal devices used for work is removed under the company remote work and personal device policy, where adopted. How long records must be kept before they are destroyed is set by the company data retention and destruction policy, where adopted; this policy covers the equipment.

IT asset

Any company-owned or leased device that stores, processes, or transmits information, including the storage media inside it.

Asset register

The company record of every IT asset, from purchase to final disposal.

Sanitization

Making data on a device or storage medium impossible to recover with reasonable effort. NIST SP 800-88 describes three methods: clear, purge, and destroy.

Clear

Overwriting or resetting storage using normal commands, which protects against simple recovery tools. Suitable only for low-sensitivity data on equipment that stays inside the company.

Purge

Using built-in secure erase commands, cryptographic erase, or other techniques that protect against recovery even with laboratory methods, while leaving the device usable.

Destroy

Shredding, disintegrating, pulverizing, or melting storage media so that data recovery is not feasible and the media can never be used again.

Cryptographic erase

Destroying the encryption key of a fully encrypted device or storage area, which makes the encrypted data unreadable. It is fast and is often the only option for cloud storage.

Certificate of sanitization or destruction

A record of each device sanitized or destroyed, with its serial number, the method, the date, and who did and verified the work.

Chain of custody

A record of who had each device, and when, from the moment it leaves service until it is destroyed or recycled.

IT asset disposition (ITAD) vendor

A company that collects retired IT equipment, sanitizes or destroys data, and resells or recycles the equipment.

E-waste

Discarded electronic equipment, which must be reused or recycled rather than thrown away.

Every IT asset is recorded in the IT management system that monitors company devices, supplemented by a register for equipment it cannot see, such as printers and spare drives. For each asset, the register records:

• Type, make, model, and serial number, and the serial numbers of removable drives where practical.
• Who it is assigned to and where it is located.
• The most sensitive kind of data it may hold, such as personal, financial, health, or customer confidential information.
• Whether it is owned or leased, and any lease return date.
• Its status: in use, in storage, awaiting disposal, sanitized, and disposed of, with dates.
• For disposed assets: the method, who performed it, the vendor, and the certificate reference.

Keeping it accurate. New equipment is added when it arrives. The register is reconciled against the IT management tools and a physical check of storage areas at least once a year, and any missing device is investigated and, if it may hold personal information, reported as a possible security incident.

1. Request: the device owner or IT requests retirement, and the IT Manager approves it.
2. Save what is needed: move any company data that must be kept to approved company storage, and confirm it is readable there.
3. Disconnect: remove the device from company accounts, device management, security tools, licenses, and the network, and turn off any "find my device" or activation lock.
4. Label and secure: tag the device as awaiting disposal and store it in a locked area with restricted access.
5. Sanitize or destroy: remove data using the method this policy requires for that kind of equipment, and verify the result.
6. Hand over: give the device to the approved vendor or recipient against a signed list of serial numbers.
7. Record: update the asset register and file the certificate.

Time limit. Retired equipment must be sanitized or handed to the approved vendor within 90 days of retirement. Equipment awaiting disposal is counted at least quarterly against the register.

Leases, warranty swaps and repairs. Leased equipment, including copiers, is sanitized before it is returned. When a failed drive is replaced under warranty, the failed drive is kept and destroyed rather than sent back, using a "keep your drive" option where the manufacturer offers one. Devices sent out for repair are sanitized first or, if that is not possible, sent only to a repairer under a written confidentiality agreement.

Data is removed following NIST SP 800-88 Rev. 2. A certified IT asset disposition (ITAD) vendor sanitizes or destroys all storage media and issues a certificate listing each device by serial number. The minimum standard for each kind of equipment is:

• Deleting files, emptying the recycle bin, or a quick reformat is never sufficient.
• Degaussing (using a strong magnet) must not be used on solid-state drives, phones, or other flash storage, because it does not remove their data.
• Multiple overwrite passes are not required and do not make solid-state drives safer; use secure erase, cryptographic erase, or destruction instead.
• Every sanitization is verified, by the tool's verification report or a sample check, and any drive that fails is destroyed.
• Data in cloud services is removed by deleting it under the retention schedule and, when a service ends, obtaining the provider's written confirmation that company data has been deleted.

Choosing a vendor. Equipment leaves the company for disposal or recycling only through a vendor approved by the IT Manager. Before approval, the company checks the vendor with due diligence, as North Carolina law expects for disposal companies: the vendor must hold a current R2 (Responsible Recycling) or e-Stewards certification for the facility that will handle the equipment, and the company reviews its certification, references, and data destruction procedures, and an independent audit where available.

Written contract. Each vendor signs a written contract that requires it to protect company data in its custody, sanitize or destroy all storage media to NIST SP 800-88 before any reuse, provide certificates, follow environmental laws and its certification standard for downstream recycling and export, carry appropriate insurance, and notify the company promptly of any loss or security incident.

Chain of custody. Devices are released only against a pickup list of serial numbers signed by both the company and the vendor, transported in locked containers or sealed vehicles, and reconciled against the vendor's certificate, which lists every device and drive by serial number. Any device missing from the certificate is investigated immediately.

Ongoing review. Approved vendors are reviewed at least once a year: certifications still current, certificates complete and on time, and no unresolved incidents.

Reuse first. Working equipment that is still secure and supported is reused inside the company, or donated or sold, after its data has been sanitized and verified. Donations and sales require the approval of the policy owner and a written record of the recipient. Devices that can no longer receive security updates are not redeployed for company use.

Never the trash. Computers, monitors, printers, phones, and other electronics are never placed in the trash or a dumpster. North Carolina has banned computer equipment and televisions from landfills since July 1, 2011. Batteries, including laptop, phone, and backup power batteries, are kept separate and recycled through the vendor or an approved battery recycling program; North Carolina law also bans lithium-ion batteries from landfills effective December 1, 2026.

Measuring results. The IT Manager reports to the Chief Executive Officer at least once a year on the number of devices reused, donated, and recycled, and the vendors used, so the company can track and report its progress.

• The asset register entry for each disposed device.
• Signed pickup lists and chain of custody records.
• Certificates of sanitization or destruction, and recycling certificates.
• Vendor approvals, contracts, certifications, and annual reviews.
• Records of donations and sales.

These records are kept for at least 3 years after disposal, or longer if a law, contract, or legal hold requires it. Equipment subject to a legal hold is not disposed of until the hold is released in writing.

North Carolina personal information. North Carolina law (N.C.G.S. 75-64) requires businesses that conduct business in the state, or hold personal information of its residents, to take reasonable measures to protect personal information when it is disposed of, including policies that require electronic media to be destroyed or erased so the information cannot practicably be read or reconstructed, and to describe those procedures in written policy. This policy is part of the [Company Name] written disposal procedures for electronic media, together with the data protection policy, where adopted.

Exceptions. Requests for an exception are made in writing to the IT Manager. Exceptions are approved by the IT Manager, or by the Chief Executive Officer where regulated data is involved, recorded, and limited to the specific devices named. No exception may allow storage media containing personal or confidential information to leave company control without sanitization or a documented chain of custody.

Enforcement. Taking, selling, giving away, or throwing out company equipment outside this policy may result in disciplinary action, up to and including termination of employment or of a contractor agreement, consistent with applicable law. Vendors that fail to meet this policy are removed from the approved list and subject to the remedies in their contracts.

Policy review. The IT Manager reviews this policy no later than October 2, 2027, and sooner after a lost device or disposal incident, a change of vendor, or a change in NIST guidance or the law.

• NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization.
• North Carolina Identity Theft Protection Act, N.C.G.S. 75-64, Destruction of personal information records.
• North Carolina landfill disposal bans (N.C.G.S. 130A-309.10) on computer equipment and televisions, effective July 1, 2011, and on lithium-ion batteries, effective December 1, 2026.
• U.S. EPA guidance on certified electronics recyclers (R2 and e-Stewards).

Related company policies. This policy works together with the [Company Name] data retention and destruction, data protection, information security, data backup and recovery, and IT supplier code of conduct policies, where adopted. If they conflict, the stricter requirement applies.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.