An ITAD client is buying proof. The devices leave the building, the data is erased and the material is resold or recycled. The chain of custody is the record that connects those events.
A missing link turns a routine project into a dispute.
Custody starts at pickup
The chain begins before the truck arrives. The client approves the asset list, the pickup address and the person authorised to hand over the devices.
At pickup, record the date, time, site, vehicle, driver and the name of the client representative. Count the boxes or pallets and photograph the sealed load.
Manifest and seals
The manifest is the bridge between the client’s list and the physical shipment. It should carry the client asset tag, serial number, category and quantity.
Seal every container and record the seal number. A seal that is broken in transit should be photographed and reported before the contents are touched.
Handovers
Every handover needs a person, a timestamp and a count: client to driver, driver to receiving, receiving to wipe bench, bench to grading, grading to resale or recycling.
A handover without a signature is an assumption. The system should block a batch from closing when a link is missing.
Erasure evidence
Record the drive or device, the erase method, the tool, the start and end time, the result and the certificate. Keep failed erasures in a separate queue with a disposition decision.
A certificate should link to the specific serial number. A batch-level certificate is weaker evidence when a client asks about one device.
Downstream receipts
Resale and recycling are destinations, not the end of the trail. Record the buyer or recycler, the transfer note, the weight where relevant and the receipt confirmation.
If material is harvested for parts, record which device the parts came from. The client may ask.
The client report
The final report should combine the manifest, custody records, erasure status, grade summary, destinations and exceptions. It should be reproducible months later, even after the workflow changes.
Generate the report from the records, not from a folder assembled by hand.
A pilot that tests the exceptions
Run one collection end to end and include a device that cannot be wiped, a box with a missing seal and an asset that is not on the manifest. The exception path is where the chain usually breaks.
A custody register and audit pack
The custody register should list the batch, the client, the site, the pickup date, the seal numbers, the handovers, the erasure status and the final destination. Each row needs a person and a timestamp.
Keep the audit pack in one place: manifest, signatures, photos, certificates, transfer notes and the exception log. A pack assembled from four folders is hard to reproduce.
Test the pack with a sample client request. Ask for the evidence for ten serial numbers and measure how long it takes to produce. If the answer is hours, the process is not ready for a large contract.
Review the pack after every project. The gaps found in a real request are more useful than a template checklist.
Choosing the erasure method
The method follows the media. Hard drives can be overwritten or degaussed; solid state drives need a method that accounts for wear levelling; encrypted devices may be sanitised by destroying the key.
Record the method, the tool and the result. A certificate that says “data erased” without the method is difficult to defend.
Keep failed devices in a separate queue. A drive that cannot be wiped should be destroyed or handled under a documented exception, not returned to stock.
The best chain of custody is boring. Every handover has a name, every device has a record and every report can be reproduced. If a client request turns into a search through email, the process is not ready for a larger contract.
FAQ
What is the most important record?
The link between the serial number and the erasure evidence. Without it, the client cannot prove the data was destroyed.
Do we need a separate system for ITAD?
A spreadsheet can work for a small pilot, but it cannot enforce handovers or link certificates at scale.
How long should records be kept?
Follow the client contract and the applicable e-waste and data protection requirements. Keep the evidence reproducible for the agreed period.
For the platform side, see ITAD software and refurbishment software. For grading after erasure, see device grading software.
