IT asset disposal checklist for Indian companies
Updated 5 Oct 2026 9 min read
The short answer
A sound IT asset disposal process has six parts. List every device by serial number. Sanitise each one to NIST SP 800-88 (Clear, Purge or Destroy) and get a certificate per device. Choose buyback, recycling or donation. Hand e-waste only to CPCB-registered entities. Track custody until the end. Have your CA settle the GST and asset write-off.
Start with an inventory and one owner
Most disposal problems start before the devices leave: a laptop nobody listed, a drive pulled from a server and left in a drawer, or a batch handed over with no paperwork. Name one person to own the disposal from start to finish. Then build the list.
- Export your asset register and match it against what is physically on the shelf. Record make, model, serial number, asset tag, the last user and the department.
- List storage separately. Laptops, desktops, servers, NAS boxes, phones, tablets, printers and copiers with internal drives all hold data. Removed drives and USB sticks count too.
- Mark each item's data sensitivity: customer personal data, financial records, source code, or nothing sensitive.
- Note the condition: working, repairable or dead. This decides whether resale is possible.
- Remove devices from management tools only after they are wiped. Release company enrolment (Apple Business Manager, Android Enterprise, Intune and similar) so the buyer can use the device.
Sanitise data to a recognised standard and certify it
The common reference is NIST Special Publication 800-88, Guidelines for Media Sanitization. Revision 2, published in September 2025, replaced the 2014 Revision 1. It keeps the three methods, Clear, Purge and Destroy. For the exact technique on each type of media it now refers to the industry standard IEEE 2883.
| Method | What NIST says it does | Typical use |
|---|---|---|
| Clear | Logical techniques on all user-addressable storage, against simple, non-invasive recovery; for example rewriting, or a factory reset where rewriting is not supported | Low-sensitivity data, or moderate where you accept that some data may be recoverable |
| Purge | Physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory methods; includes cryptographic erase and the drive's built-in sanitise commands | Devices going for resale or donation that held personal or confidential data |
| Destroy | Makes recovery infeasible with laboratory methods and leaves the media unusable, e.g. shredding, disintegrating, pulverising | Failed drives that cannot be purged, or the most sensitive data |
NIST notes that purge, and clear where acceptable, can be a better choice than destruction when you want to resell or donate devices or have environmental concerns. For SSDs and phones, use the device's own sanitise command or cryptographic erase rather than a simple overwrite. Overwriting does not reliably reach every block on flash storage.
After sanitising, NIST says to complete a certificate of sanitisation for each device. It should record the manufacturer, model and serial number, media type, the method (clear, purge or destroy), the technique and the tool with its version, how it was verified, and the name, title, date, location and signature of the person who verified it. A vendor's batch certificate is only useful if it lists your serial numbers.
Under the Digital Personal Data Protection Act, 2023, failing to take reasonable security safeguards against a personal data breach can attract a penalty of up to ₹250 crore. The DPDP Rules, 2025 bring most organisations' substantive duties into force from 13 May 2027. A device sold with customer data still on it is exactly the kind of breach the Act is about.
Buyback, recycling or donation
Data comes first whichever route you choose. After that, the right route depends on the device's age and condition.
| Route | Suits | Paperwork to get | Watch for |
|---|---|---|---|
| Buyback / resale | Working devices a few years old | Tax invoice from you to the buyer (or as your CA advises), asset list with serials, data-wipe certificate | Quotes that drop after inspection; buyers who will not commit to a wipe standard |
| Recycling | Dead, very old or damaged equipment | Handover challan, recycler's CPCB registration details, recycling or disposal certificate | Collectors who cannot show a registration; any sign of informal stripping |
| Donation | Working devices going to a school or NGO | Deed or letter of donation, asset list, wipe certificate | Donations have their own GST and income-tax treatment; the recipient will later need a disposal route too |
| Return to vendor or lessor | Leased equipment or vendor take-back | Return note, vendor's wipe confirmation | Lease terms may require you to wipe to a specific standard before return |
One option for Bengaluru-area companies: SwapMyTech buys used laptops in bulk from companies with a GST invoice and a data-wipe certificate. You can ask for a quote through our contact page.
E-Waste Rules duties and chain of custody
Under the E-Waste Management Rules 2022, an entity that has used at least 1,000 units of listed electrical and electronic equipment at any point in a financial year is a bulk consumer. Laptops, desktops, phones, printers, monitors, routers and UPS units all count. Rule 8 requires bulk consumers to hand e-waste only to a registered producer, refurbisher or recycler. The 2022 rules removed the old duty to file annual returns.
The rules do not say whether a working laptop sold for reuse is e-waste. Rule 3 defines e-waste as equipment discarded as waste. If you are a bulk consumer, confirm your position with your adviser, and ask any buyer or recycler for its CPCB portal registration. In Karnataka, KSPCB also runs an e-waste bulk consumer listing form.
Chain of custody means you can show where every device was from the day it left a desk to the day it was wiped, sold or recycled:
- Collect devices into one locked room or cage. Log each one in against the inventory.
- Seal batches in numbered boxes or bags. Record the seal numbers.
- At handover, both sides sign a list of serial numbers and seal numbers. Photograph the batch.
- Wherever wiping happens, compare the vendor's certificates against your list and chase any gaps.
- Close the record: each serial marked sold, donated, returned or recycled, with the document that proves it.
GST, write-off and the books
Selling used company IT equipment is generally a taxable supply, so the paperwork needs your accountant's input. Points to raise with your CA:
- Input tax credit on capital goods: if you claimed ITC when you bought the equipment, section 18(6) of the CGST Act, read with rule 40(2), requires you to pay the higher of the ITC reduced by five percentage points per quarter since the invoice date, or the tax on the sale value.
- Invoice: who issues the invoice, at what value and with what HSN code.
- Fixed asset register: remove the sold or scrapped assets and record any gain or loss on disposal in the accounts.
- Income-tax depreciation: how the sale proceeds affect the depreciation block for computers.
- Donations and scrapping: the GST and income-tax effect of giving equipment away or scrapping it for nothing.
This section is general information, not tax or legal advice. Treatment depends on your registration, how the assets were bought and how they were accounted for. Confirm with your chartered accountant before you sign a disposal invoice.
The IT asset disposal checklist
Copy this table into a spreadsheet and keep one row per batch, with the evidence linked.
| Stage | Task | Owner | Evidence to keep |
|---|---|---|---|
| Plan | Name a disposal owner and approve the batch | IT head / finance | Approval email or note |
| Inventory | List devices with serials, tags, condition and data sensitivity | IT | Inventory sheet |
| Inventory | List removed drives and media separately | IT | Media list |
| Prepare | Back up needed data; release MDM, device locks and licences | IT | Release log |
| Sanitise | Clear, purge or destroy per NIST SP 800-88 based on sensitivity | IT or vendor | Per-device certificate of sanitisation |
| Verify | Spot-check wiped devices; reconcile certificates to serials | IT | Verification notes |
| Route | Decide buyback, recycling, donation or return per device | IT / finance | Decision list |
| Compliance | If a bulk consumer, check the receiver's CPCB registration | Admin / EHS | Registration details |
| Handover | Seal, sign the serial list, photograph the batch | IT + receiver | Signed handover sheet |
| Finance | Invoice, ITC reversal check, write-off in the asset register | Finance / CA | Invoice, journal entry |
| Close | Mark each serial with its final status and proof | Disposal owner | Closed register |
Questions people ask
- What is NIST 800-88 and why do buyers mention it?
- NIST SP 800-88 is a US government guideline on media sanitisation that is widely used as a reference in India. It sets three levels, Clear, Purge and Destroy. Revision 2 was published in September 2025 and replaced the 2014 version.
- What should a data destruction certificate include?
- Per NIST SP 800-88 Rev. 2: manufacturer, model and serial number, media type, the method and technique used, the tool and its version, the verification method, and the name, title, date, location and signature of the person who verified it. It should cover each device, not just a batch.
- Is our company a bulk consumer under the E-Waste Rules?
- If it has used at least 1,000 units of the equipment listed in Schedule I of the E-Waste (Management) Rules, 2022 at any point in a financial year, yes. Bulk consumers must hand e-waste only to a registered producer, refurbisher or recycler.
- Is physical shredding safer than wiping?
- Destruction removes the media entirely, but it also removes any resale value. NIST notes that purge techniques can be more appropriate when you want to reuse, sell or donate devices. Use destruction for failed drives that cannot be purged and for the most sensitive data.
- Do we need to reverse input tax credit when selling old laptops?
- If ITC was claimed on them, section 18(6) of the CGST Act and rule 40(2) of the CGST Rules apply. You pay the higher of the reduced ITC or the tax on the sale value. Confirm the figures with your CA.
Next steps
Sources
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025) · accessed 5 Oct 2026
- NIST SP 800-88 Rev. 2, full text (PDF) · accessed 5 Oct 2026
- E-Waste (Management) Rules, 2022 (CPCB copy) · accessed 5 Oct 2026
- CPCB: all EPR portals of CPCB · accessed 5 Oct 2026
- KSPCB: E-Waste Management page (bulk consumer listing form) · accessed 5 Oct 2026
- Digital Personal Data Protection Act, 2023 (MeitY) · accessed 5 Oct 2026
- S.S. Rana & Co.: MeitY notifies final DPDP Rules 2025 (phased commencement) · accessed 5 Oct 2026
- Lakshmikumaran & Sridharan: ITC reversal on sale of used capital goods · accessed 5 Oct 2026