ITAD (IT asset disposition) is the secure, compliant process of retiring IT equipment through data destruction, resale, recycling, or disposal.
ITAD (IT asset disposition) is the secure, compliant process of retiring IT equipment - laptops, phones, servers, drives - through data destruction followed by resale, donation, recycling, or disposal. The term covers both the discipline and the industry: “doing ITAD” means retiring hardware in a controlled, evidenced way, and “an ITAD vendor” is a company that does it for you. The core problem it solves is simple: almost every retired device is a data-bearing device, and throwing one away untreated means throwing away readable data.
Why ITAD exists
Two pressures created the field. The first is data: deleted files and even formatted drives are routinely recoverable, so a skip full of old laptops is a breach waiting for a curious finder - and data protection law does not stop applying because the hardware was cheap to replace. The second is environmental: electronics are hazardous waste, and rules such as the WEEE Directive in the EU restrict how they may be discarded. ITAD is the practice that satisfies both at once, while recovering whatever resale value the equipment still holds.
The ITAD process, step by step
- Identify and inventory - list what is being retired, with serial numbers, against the asset register.
- Collect and secure - devices move into controlled custody; reputable vendors document a chain of custody from pickup onwards.
- Sanitize or destroy - every drive is wiped to a recognised standard or physically destroyed; see data sanitization for the methods.
- Disposition - each device gets its best outcome: refurbishment and resale, parts harvesting, donation, or certified recycling.
- Evidence - you receive serial-level reports and a certificate of destruction for data-bearing items, which you reconcile against your register and keep.
The reconciliation step is the one teams skip and regret: if 48 laptops left the building and the report lists 47, you want to notice now, not during an audit.
What to expect from an ITAD vendor
Look for documented chain of custody, sanitization to a published standard, serial-level reporting, and certificates you can retain. Industry certifications exist for both the security and environmental sides - asking a vendor which ones they hold, and what happens to devices they cannot resell, separates professionals from scrap dealers quickly. Many vendors share resale proceeds, so a well-run disposal batch can fund part of its replacement cycle.
ITAD in practice
ITAD works only as well as the register feeding it. The habit that holds up: mark devices as retired the day they leave service, keep them in a controlled location rather than a drawer economy, and batch them to disposal with serials listed. In AMPthilly, setting an asset’s status to retired, attaching the vendor’s certificate to the asset record, and letting the audit history carry the trail means every device’s end of life is provable from the same place its purchase was recorded. The same lifecycle logic applies beyond IT - retiring autoclaves or other regulated equipment also needs an evidenced final step, just without the data-destruction layer.
Common mistakes
- The cupboard fleet. Retired laptops accumulating in storage are unsanitized data, depreciating value, and audit gaps all at once.
- Trusting a factory reset. A reset is not certified sanitization, especially for drives pulled from servers, copiers, and network gear.
- No serial reconciliation. Without matching the vendor’s report to your register, “we disposed of them all” is a hope, not a record.
- Treating donation as a shortcut. Donated devices need the same data destruction as recycled ones - goodwill does not survive a data leak.
Related terms
- Data Sanitization - the wiping and destruction methods at the heart of ITAD
- Data-Bearing Device - the equipment class that makes disposal a security task
- Certificate of Destruction - the evidence an ITAD vendor must provide
- E-Waste - what retired electronics become without a controlled process
- WEEE Directive - the EU rules governing electronic waste disposal