Template draft. Replace everything in [square brackets] with your own decision,
delete what does not describe what you really do, and approve it through your own document control. It is not legal
advice and does not make an organisation compliant or certified.
1. Purpose
This process makes sure that equipment, storage media and paper that leave service are treated so that no information can be recovered from them, that every item is accounted for until it is gone, and that disposal also meets environmental, financial and contractual duties. It applies from the decision to retire an asset to the closing of its record.
- Prevent data leakage through discarded, resold, donated, returned-lease or repaired equipment.
- Keep the asset register accurate so that a missing device is noticed and a disposed one is not counted as live.
- Produce evidence, in the form of certificates and signed records, that satisfies customers and auditors.
- Recycle responsibly through authorised handlers.
2. Scope
- In scope: laptops, desktops, servers, network and storage devices, mobile phones and tablets, removable media, printers and scanners with storage, backup tapes, hardware tokens and smart cards, and paper and optical media holding Organisation information; also virtual machines, cloud storage volumes and databases released at end of life.
- In scope people: employees and contractors who own, return, move or dispose of assets, and every disposal vendor.
- Out of scope: consumables with no storage (cables, furniture), which follow normal waste handling, and customer-owned equipment, which is returned to the customer.
- Applies to all sites and to home-based and remote workers who hold Organisation equipment.
3. Terms and Definitions
| Term | Meaning |
|---|
| Disposal | Any permanent removal of an asset from the Organisation's control: destruction, recycling, sale, donation, return to lessor or transfer. |
| Sanitisation | Making stored data unrecoverable by an approved method. |
| Clear | Overwriting data using standard commands so that ordinary tools cannot recover it. |
| Purge | Using a method such as cryptographic erase or firmware secure erase so that laboratory attacks cannot recover data. |
| Destroy | Physically damaging media so that it cannot be used and data cannot be recovered. |
| Cryptographic erase | Destroying the encryption key that protects media so that the data becomes unreadable. |
| Certificate of destruction | A signed document from the party that performed destruction, listing the items and method. |
| Chain of custody | The record of who held an asset, when and where, during transport and handover. |
4. Roles and Responsibilities
| Role | Responsibilities |
|---|
| Document owner (Head of IT) | Owns the process, approves disposal vendors and methods, and reports exceptions. |
| Asset owner / user | Returns the asset, confirms removal of personal items, and reports lost or stolen assets. |
| IT asset custodian | Verifies the asset, performs or arranges sanitisation, updates the register and manages the storage cage. |
| Information security team | Sets sanitisation standards, approves exceptions, and samples sanitised devices for recovery. |
| Facilities and security | Controls physical movement, escorts vendors, and keeps the secured storage area. |
| Finance | Records write-off, sale proceeds or lease return, and verifies depreciation. |
| Disposal vendor | Collects, destroys or recycles under contract, and provides certificates and environmental documentation. |
| Activity | Responsible | Accountable | Consulted | Informed |
|---|
| Initiate disposal request | Asset owner | Department head | IT asset custodian | Finance |
| Verify asset and data classification | IT asset custodian | Head of IT | Information security team | Asset owner |
| Sanitise or destroy | IT asset custodian | Head of IT | Information security team | Asset owner |
| Transport and handover to vendor | Facilities and security | Head of IT | IT asset custodian | Finance |
| Verify certificates and close record | IT asset custodian | Head of IT | Information security team | Finance |
| Approve vendor and method exceptions | Information security team | Head of Information Security | Head of IT; Legal and compliance | Senior management |
5. Entry Criteria
A disposal begins only when all of the following are true.
- The asset is recorded in the asset register with an owner and classification.
- The reason for disposal is one of: end of useful life, failure beyond economic repair, replacement, end of lease, security concern, or a decision to retire the service it supported.
- A disposal request form (Annexure A) is approved by the department head and, for items above [INR 100000] book value or holding Restricted data, by the Head of IT.
- Any legal hold, audit, investigation or contractual retention that applies to the data on the asset has been checked and lifted by legal and compliance in writing.
- Required data has been migrated or backed up and its owner has confirmed this.
6. Input
| Input | Source |
|---|
| Approved disposal request form | Asset owner and department head |
| Asset register entry, with serial number, tag and classification | IT asset custodian |
| Return confirmation of the asset and its accessories | Asset owner |
| Data migration or backup confirmation | System owner |
| Legal hold clearance | Legal and compliance |
| Lease, warranty or buy-back terms | Procurement and Finance |
| Approved vendor list and contract | Head of IT |
7. Tools and Aids
- Approved data sanitisation software and firmware secure erase tools that produce a log per device.
- Mobile device management console for remote wipe and removal of managed phones and laptops.
- Degausser, shredder or crusher rated for the media types, or an approved vendor's service.
- Tamper-evident bags, seals and numbered containers; a lockable secure storage cage with access log.
- Asset tagging and barcode scanner; the asset register and the ticketing tool.
- Paper shredder meeting the cross-cut size required by the Information Classification and Handling Policy.
8. Detailed Process
8.1 Process flow diagram
The flow is described as numbered stages; each stage hands the asset and its record to the next owner.
- Request approved and legal hold cleared.
- Asset collected and checked against the register.
- Data owner confirms backup and migration; asset moved to secured storage.
- Sanitisation method chosen from the method table.
- Sanitisation done and verified; log attached.
- Asset tagged for reuse, resale, destruction or recycling.
- Handover to vendor with chain of custody, or in-house destruction witnessed.
- Certificate received and checked.
- Register updated, finance informed and record closed.
8.2 Sanitisation methods
| Asset or media | Restricted or Confidential data | Internal or Public data | Verification |
|---|
| Solid state drive and flash storage | Cryptographic erase or firmware purge, then destroy if the device does not support it | Clear or purge | Attempt recovery on a sample; check erase log |
| Magnetic hard disk | Purge by overwrite or degauss, then shred if leaving the Organisation uncontrolled | Clear with single-pass overwrite | Read-back test; log |
| Mobile phone and tablet | Remote wipe, factory reset, remove account locks and SIM or card | Factory reset | Confirm device is unenrolled |
| Server and storage array | Purge each drive; cryptographic erase of encrypted volumes | Clear each drive | Per-drive log |
| Network and security devices | Factory reset, remove configuration and keys, revoke certificates | Factory reset | Check configuration is empty |
| Backup tape and optical disc | Degauss or shred | Overwrite or shred | Certificate |
| Paper | Cross-cut shred or pulp by authorised vendor | Shred | Witness or certificate |
| Cloud volume or virtual machine | Delete after revoking keys; confirm provider deletion | Delete | Provider confirmation |
| Hardware token and smart card | Revoke credentials, physically destroy | Revoke, destroy | Revocation record |
8.3 Process description
- Raise requestThe asset owner completes the disposal request form (Annexure A) and submits it in the ticketing tool. Time target: within [5 working days] of the decision.
- ApproveThe department head approves; the IT asset custodian checks that the asset is registered and flags classification. Time target: [3 working days].
- Check holdsLegal and compliance confirms there is no hold, litigation, audit or retention need on the data. Time target: [3 working days].
- CollectThe asset is returned to the IT asset custodian with accessories, passwords removed or recorded, and the receipt is signed. Remote workers use a tracked courier in tamper-evident packaging.
- Back up and migrateThe system owner confirms in writing that needed data is copied and verified before the device is wiped. Time target: [5 working days].
- Store securelyAssets awaiting disposal are logged into the secured storage area with an access log and held for no more than [30 days].
- Remove tags and accessRemove the asset from management tools, revoke certificates and device accounts, release licences and update the network inventory.
- SanitiseApply the method from the sanitisation methods table; attach the tool's log to the ticket. Time target: [5 working days] from collection. A failed wipe means the device is destroyed.
- VerifyA second person, or information security for Restricted data, confirms the result and samples at least [5 percent] of devices by attempting data recovery.
- Decide routeReuse inside the Organisation, resale or donation (only for devices with proven purge and no Restricted history), return to lessor, or destruction and recycling. Finance confirms the route for assets with residual value.
- Hand overPack in sealed, numbered containers; record the chain of custody; a security-approved vendor collects with identification checked and a signature from both parties.
- Receive proofThe vendor sends a certificate of destruction or recycling within [10 working days] listing serial numbers, method and date (template in Annexure D), plus environmental compliance documents.
- Reconcile and closeMatch certificate to the register and the request; update the asset register to Disposed; notify Finance for write-off; close the ticket.
- ReviewInformation security reviews disposal logs and vendor certificates each [quarter] and reports gaps.
Note. A device that cannot be proven sanitised is treated as holding Restricted data and is destroyed. Resale and donation of equipment that has stored Restricted data is not allowed.
8.4 Special cases
| Case | Rule |
|---|
| Lost or stolen asset | Report within [4 hours]; remote wipe attempted; incident raised under the Incident Management Procedure; register marked Lost and write-off follows the Finance rule. |
| Leased equipment | Wipe before return; obtain the lessor's receipt; keep the sanitisation log. |
| Faulty device sent for repair or warranty | Remove or encrypt storage where possible; use a contracted vendor under an NDA; if the drive cannot be removed or wiped, retain it and do not return to the vendor. |
| Staff purchase of retired devices | Only Public-class devices that have been purged, and only with Head of IT approval. |
| Employee personal device used under bring-your-own-device | Remove Organisation data and the management profile on exit as per the Mobile Device Management Procedure. |
| Bulk disposal after office closure | Scheduled project with its own plan, witnessed destruction on site and consolidated certificates. |
9. Escalation Matrix
| Situation | First contact | Escalate to | Within |
|---|
| Asset missing from collection or storage | IT asset custodian | Head of IT, then Head of Information Security | [4 hours] |
| Sanitisation fails or log missing | IT asset custodian | Information security team | [1 working day] |
| Vendor does not deliver certificate | IT asset custodian | Head of IT, then Procurement | [10 working days] after handover |
| Evidence that data was recoverable from a disposed device | Information security team | Head of Information Security and senior management; follow the Incident Management Procedure | Immediately |
| Disagreement about legal hold or retention | Legal and compliance | Head of IT | [2 working days] |
| Environmental or regulatory finding about the vendor | Procurement | Head of IT and Legal and compliance | [5 working days] |
10. Output
- Sanitised and verified assets, or destroyed assets with certificates.
- Updated asset register showing status Disposed, date, method and vendor.
- Disposal log and sanitisation tool logs attached to the ticket.
- Signed chain-of-custody record and vendor certificate of destruction or recycling.
- Finance entry for write-off, sale proceeds or lease return.
- Quarterly disposal report to the information security steering group.
11. Exit Criteria
- Every item on the request has a certificate or a log that identifies it by serial number.
- The asset register is updated and Finance has confirmed the accounting treatment.
- No data-bearing asset remains in the secured storage area beyond [30 days] unless a recorded reason exists.
- Licences are released, accounts are removed, and certificates for the device are revoked.
- All discrepancies are closed or escalated.
- The request is closed in the ticketing tool by the IT asset custodian and checked by a second person.
12. Measures
| Measure | Target | How it is measured |
|---|
| Disposals with a complete certificate or log | [100 percent] | Closed requests against register |
| Assets sanitised within [5 working days] of collection | [95 percent] | Ticket timestamps |
| Retired assets still marked Active after [30 days] | [0] | Register reconciliation |
| Recovery tests on sanitised sample showing data found | [0] | Sample test results |
| Vendor certificates received within [10 working days] | [95 percent] | Vendor tracker |
13. Reference Documents
13.1 Processes
- Asset Management Procedure; Physical and Environmental Security Procedure; Mobile Device Management Procedure; Key Management Process; Incident Management Procedure.
13.2 Guidelines
- Information Classification and Handling Policy for classification-to-method mapping; Data Protection and Privacy Procedure for personal data on retiring assets.
13.3 Checklists and forms
- Annexure A disposal request form; Annexure B disposal checklist; Annexure C disposal register; Annexure D certificate of destruction template.
14. Records and Evidence
| Record | Kept by | Location | Retention |
|---|
| Disposal requests and approvals | IT asset custodian | Ticketing tool | [3 years] |
| Sanitisation logs | IT asset custodian | Document management system | [3 years] |
| Certificates of destruction | IT asset custodian | Document management system | [7 years] |
| Chain-of-custody forms | Facilities and security | Document management system | [3 years] |
| Disposal register | IT asset custodian | Asset register | [7 years] |
| Field | Entry |
|---|
| Asset tag, type and serial number | |
| Owner and department | |
| Classification of data held | |
| Reason for disposal | |
| Backup or migration confirmed by | |
| Legal hold check (name, date) | |
| Proposed route (reuse, resale, return, destruction) | |
| Book value | |
| Department head approval and date | |
| Head of IT approval (if required) and date | |
Annexure B: Disposal checklist
| Step | Done (Y/N) | By | Date |
|---|
| Request approved and hold cleared | | | |
| Data backed up or migrated | | | |
| Asset received and matched to register | | | |
| Removed from management tools and accounts | | | |
| Sanitised and log attached | | | |
| Verification done by second person | | | |
| Chain of custody signed | | | |
| Certificate received and matched | | | |
| Register and Finance updated | | | |
Annexure C: Disposal register
| Ref | Asset tag | Serial | Method | Date | Vendor | Certificate no. |
|---|
| D-0001 | [LT-0451] | [SN123] | Purge and recycle | [1 Mar] | [Vendor X] | [C-901] |
| | | | | | |
| | | | | | |
Annexure D: Certificate of destruction template
| Item | Detail |
|---|
| Certificate number | |
| Issued by (company, address, authorisation number) | |
| Issued to | The Organisation |
| Date and place of destruction | |
| List of items (tag and serial numbers) | |
| Media type and classification | |
| Method used and standard followed | |
| Witness for the Organisation (name and signature) | |
| Statement: the above items were destroyed as stated and no data remains recoverable | |
| Name, title, signature and date of vendor representative | |
| Disposal of resulting waste (recycler and document reference) | |
15. Exception
Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.
16. Enforcement
Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.
17. Review
This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.
ISO/IEC 27001:2022 references
| Reference | Title |
|---|
| A.7.14 | Secure disposal or re-use of equipment |
| A.7.10 | Storage media |
| A.5.11 | Return of assets |
| A.5.9 | Inventory of information and other associated assets |
| A.8.10 | Information deletion |