When business IT equipment leaves a site, the organisation should still be able to explain where it went, who handled it and what happened to the information it contained. An auditable chain of custody is the record that connects those events. It is especially valuable for laptops, servers and removable drives that may hold personal or commercially sensitive data.
A signed collection note is a useful starting point, but it does not by itself prove that every drive was sanitised or destroyed. The evidence needs to follow the asset through processing and final disposition.
Begin with an agreed inventory
Before collection, agree the scope with the customer: locations, approximate quantities, asset types, authorised contacts and the identifiers to be captured. A serial number or asset tag makes later reconciliation easier. Where a drive can be removed from a server or laptop, decide whether the drive needs its own identifier and processing record.
At handover, record the date, location, responsible parties and actual item count. Mark differences between the planned list and the physical equipment. A missing label or unexpected device should be logged as an exception, not silently treated as a match.
Track each transfer
A useful custody record shows the person or team releasing an item, the recipient, the time, and the next location. Depending on the project, that may cover handover to a collection engineer, loading, transport, receipt into a processing area and movement to a sanitisation or destruction station. Access controls and secure storage matter while media awaits treatment.
For sensitive or valuable assets, the NCSC says more detailed chain-of-custody tracking may be appropriate when equipment moves between people or teams. The detail of the log should reflect the customer's risk assessment and the equipment involved.
Link data handling to the asset
The final record should answer what happened to each data-bearing item. Was the medium successfully sanitised for reuse, physically destroyed, or held as an exception? Link the result to the original asset or drive identifier. A certificate becomes more useful when the customer can trace it back to equipment on the collection list.
Do not treat a failed sanitisation attempt as a successful one. Record the failure, isolate the item as required and agree its next treatment. If the customer needs evidence such as a processing log, photographs or a witness record, agree the format before the work starts.
Reconcile the project before sign-off
Compare the collected inventory with received, processed and disposed items. Investigate any difference in counts or identifiers. Keep an exception list showing the issue, owner, action and resolution. The final report should make it possible to trace an item from collection to its processing outcome and subsequent reuse or recycling route.
The ICO's audit guidance calls for records showing secure disposal of hardware assets, such as destruction logs and certificates, and for evidence of secure disposal from third parties. A certificate is part of the evidence; the underlying inventory and transfer records make it auditable.
Questions to ask your ITAD provider
- Which identifiers are recorded at collection and at processing?
- How are transfers, transport and temporary storage documented?
- What happens if an item or serial number does not match the initial list?
- Can each destruction or sanitisation result be traced to the collected asset or drive?
- Who investigates exceptions and signs off the final reconciliation?
Compritech can discuss an engineer-led collection and processing workflow with asset records, applicable evidence and project reporting agreed in advance.
Further guidance
ICO: Asset management and secure hardware disposal — https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/information-and-cyber-security/asset-management/
ICO: Disposal and deletion — https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/records-management/disposal-and-deletion/
NCSC: Decommissioning assets — https://www.ncsc.gov.uk/guidance/decommissioning-assets
Need an auditable IT disposal process?
Compritech provides engineer-led IT asset disposal with asset recording, secure data handling, chain-of-custody controls and project evidence agreed in advance.
Explore IT Asset DisposalDiscuss your project