The security of an IT asset disposal process is often judged by what happens at the processing facility — how data is wiped, how equipment is destroyed. But the collection stage, when equipment first leaves your premises, is where a surprising proportion of real-world incidents actually originate, and it deserves the same level of scrutiny.

A secure collection starts with verified identification of the collection team. This sounds basic, but it is a genuine control point — staff or facilities teams releasing equipment should be able to confirm the identity of whoever is collecting it against pre-arranged details, not simply hand equipment to whoever turns up in a branded van. For higher-sensitivity collections, some organisations require advance notice of the specific vehicle registration and staff names attending.

Asset logging at the point of collection is the next critical step, and it should happen before equipment leaves the building, not after it arrives at a processing facility. A collection team should be working from, or creating, an itemised list — serial numbers, asset tags, device types and quantities — ideally counter-signed or verified by someone from your own organisation present at collection. This single document becomes the anchor point for everything that follows: it is what a final reconciliation report is checked against, and it is the first entry in a genuine chain of custody.

Transport security is where many organisations’ understanding stops short. Vehicles carrying IT equipment, particularly where volumes or sensitivity are significant, should be GPS-tracked in real time, and ideally lockable and, for the most sensitive collections, sealed with numbered tamper-evident seals recorded at both collection and delivery. This closes the gap between “we handed it to them” and “we can prove nothing happened to it in transit” — a distinction that matters considerably if a data protection incident is ever investigated.

For genuinely high-risk data — certain financial records, health data, or government-classified information — on-site data destruction removes the transport risk from the equation entirely, since sanitisation or destruction happens before equipment ever leaves the building, witnessed by your own staff if required. This comes at a higher cost than off-site processing and is not necessary for the majority of standard business equipment, but it is worth having available as an option for the subset of assets that warrant it.

Finally, every collection should generate documentation immediately — a signed collection manifest, ideally issued on the day rather than days later, giving your organisation contemporaneous evidence of what left your premises and when. A provider who cannot produce this promptly is asking you to simply trust that the collection happened as described, which is not a reasonable basis for a secure chain of custody.