If you’ve run a refresh, you know the moment. The new servers are racked, the cutover went clean, and the old gear is shrink-wrapped on a pallet by the dock. Someone says, “Just get it out of here.”
It feels like the end of the project. It isn’t the end of the risk.
Those drives still hold data. Your contracts and regulators still expect you to account for every asset. And if that gear ends up somewhere it shouldn’t, your company’s name goes with it. Responsible ITAD (IT asset disposition) is how you close that out, and the partner you hand it to becomes the last owner of your data.
The risk doesn’t leave when the equipment does
The data is still there. Deleting files or reformatting a drive doesn’t erase the data. And it isn’t only servers: laptops, SSDs, phones, and network gear with stored configs all leave the building carrying something.
The obligations are still there. Privacy rules and customer contracts can require proof of how data-bearing equipment was handled at end of life. “We recycled it” isn’t proof.
The liability is still there. Electronics contain lead, mercury, and other hazardous materials. Many states regulate e-waste, and dumped equipment can be traced back to the company that owned it.
A rule worth stealing: list every data-bearing device by serial number before it leaves the building. If you can’t list it, you can’t prove what happened to it.
What responsible ITAD looks like
Responsible ITAD isn’t a truck and a handshake. It’s a documented process from your dock to the last recycler. Here’s what to expect from any provider, whether you work with us or not.
A chain of custody you can trace
Every asset should be tracked from pickup to final disposition. Ask who handles it, how it’s transported and stored, and how each hand-off is logged. Gaps in custody are where assets go missing.
Sanitization to NIST SP 800-88
NIST SP 800-88 is the widely used US standard for media sanitization. It lays out three levels: clear, purge, and destroy. The right one depends on the media and how sensitive the data is. Secure data destruction means your provider can tell you which method applies to which device, and why.
Proof on paper
You should get a certificate of sanitization or destruction that lists the assets, the method, the date, and who did the work. Look for reporting down to the serial number, not “40 laptops processed.” That’s the document you hand an auditor or a customer when they ask where the old drives went.
R2-compliant downstream recycling
What happens after sanitization matters too. Ask where materials go once they leave the processing facility and who handles them next. You want R2-compliant downstream recycling, not “we send it to a guy.”
Certifications to ask for, and what they mean
Certifications tell you a provider has been independently audited. They’re held by the ITAD provider and its facilities, so ask for current certificates and make sure they cover the site that will actually process your equipment.
- NAID AAA: secure data destruction, including process, security, and employee screening, with unannounced audits.
- e-Stewards: responsible electronics recycling and data security. It bars exporting hazardous e-waste to developing countries and sending it to landfill.
- R2v3: the Responsible Recycling standard, covering data security, environmental, and worker safety practices across the reuse and recycling chain.
- RIOS: the Recycling Industry Operating Standard, a management system that ties quality, environmental, and health and safety practices together.
- ISO 14001: the international standard for environmental management systems.
One more check: most certifying bodies publish a public directory. A two-minute lookup tells you a certificate is current.
Red flags
- No documentation. If a provider can’t show you a sample certificate and asset report before pickup, don’t expect one after.
- A vague downstream. “We recycle it” isn’t an answer.
- “Free” pickup with no reporting. Someone is paying for the truck. If it isn’t you, ask what happens to your drives.
- Certifications they can’t produce. A logo on a website isn’t a certificate.
How PB&J ITAD works: one rep for buying and retiring
PB&J ITAD is delivered through certified partners. Our partners hold NAID AAA, e-Stewards, R2v3, RIOS, and ISO 14001 certifications, sanitize media to NIST SP 800-88, and use R2-compliant downstream recycling. Certificates of sanitization/destruction and serialized reporting come standard on every job.
What that means for you is simple: you buy and retire through the same rep. The rep who sourced your new equipment coordinates the retirement of the gear it replaces. No new vendor to vet, no second relationship to manage, and the paperwork ready when someone asks. That matters most on large refresh projects, where the old gear has to be out before the new gear can go in.
To be clear about where the line is: our certified partners do the processing. Your rep stays your single point of contact from the first call to the final report.
We’re vendor-agnostic on the buying side, and just as straight on the retiring side. If something isn’t a fit, you’ll hear it from us first.
Got gear to retire? Tell us what you’ve got.
Whether it’s a closet of old laptops or racks coming out of a refresh, start with a quick conversation. Send us what you have, even a rough list, and we’ll walk you through the process and the documentation you’ll get at the end.
We find the yes.