Businesses often focus their attention on how a drive is wiped or destroyed, and understandably so — it is the step that determines whether data can be recovered. But a data breach during an ITAD process is just as likely to occur before that point, during collection, transport or storage, as it is during sanitisation itself. This is why chain of custody deserves equal weight in any responsible disposal policy.
Chain of custody refers to the documented, unbroken record of who has had control of an asset from the moment it is decommissioned to the moment it is sanitised, resold, or destroyed. A robust chain of custody answers a simple question at every stage: where is this device, and who is responsible for it right now? Gaps in that record are where risk lives.
In practice, a properly managed chain of custody starts with asset capture at the point of collection — serial numbers, asset tags and device details logged before anything leaves the site, ideally with the customer’s own IT team present or able to verify the list independently. Vehicles used for transport should be GPS-tracked, and where volumes or sensitivity justify it, locked and sealed with tamper-evident seals that are checked on arrival at the processing facility. Some organisations, particularly in finance, healthcare and the public sector, require on-site data destruction specifically to remove the transport stage from the equation entirely, accepting a higher cost for a shorter chain.
Once on-site at the processing facility, custody continues through site access controls, CCTV coverage of sanitisation and destruction areas, and individual accountability for who handled which device. Every device should be traceable, by serial number, through collection, sanitisation, and final disposition — resale, donation, or material recovery — with a certificate issued that ties back to that specific asset rather than a generic batch statement.
The gap many organisations do not consider is what happens between decommissioning and collection. Equipment sitting in an unlocked store cupboard for weeks, or handed to a courier without any tracking, undermines everything that happens afterwards, however rigorous the sanitisation process is. Chain of custody has to be treated as a single continuous thread, not a set of checks that only begin once equipment reaches a processing facility.
When evaluating an ITAD partner, ask to see their chain of custody documentation for a typical job, not just their data erasure certificates. A provider confident in their process will show you exactly how a device is tracked from your office door to final certification, with no unaccounted gaps in between.