IT Asset Disposal Checklist
An IT asset disposal checklist for laptops, phones and drives: back up, remove from MDM and accounts, wipe securely, record proof and recycle or resell safely.
- Typical schedule per device
- The checklist 4 sections, 17 items
- Variables
{{asset_tag}}
Use this checklist when a company laptop, phone, tablet, server or loose drive leaves service for good: sold, donated, recycled or returned at the end of a lease. Reassigning a device to a colleague is a different job; use the new laptop setup checklist for that.
Who owns it
IT or the office manager who looks after hardware owns the run. If a disposal company collects the devices, the run owner checks their certificate against the asset register. Keep the completed run, because it is your proof of what happened to each device.
Common pitfalls
- Wiping a device that is still locked to an account. If Activation Lock, a Google account lock or Autopilot registration stays on, the buyer or recycler cannot use the device. Release it from your MDM and enrolment programme first.
- Deleting files instead of wiping. Moving files to the bin or a quick format leaves data that can be recovered. Use the built-in erase function on encrypted devices, or a proper wipe tool.
- Forgotten local data. Some people keep the only copy of something on their laptop. Check with the last user before you wipe.
- No proof. When an auditor or a customer asks, "the recycler took it" is not an answer. Keep the serial number, wipe method, date and the disposal certificate.
- Drives that do not boot. A failed disk still holds data. Destroy it physically or send it to a provider that issues a destruction certificate.
Data protection rules on device disposal differ by jurisdiction. Treat this as a practical checklist, not legal advice.
The checklist: Dispose of device {{asset_tag}}
Before the wipe
-
Device
{{asset_tag}}identified in the asset register with its serial number -
Last user confirmed that no needed data is stored only on the device
-
Needed data backed up or moved to company storage optional
-
Software licences tied to the device deactivated or released
-
Device removed from user accounts (Apple ID, Google account, Microsoft account) and Find My turned off
Release from management
-
Device released from the enrolment programme (e.g. Apple Business Manager, Windows Autopilot, Android zero-touch)
Without this the next owner sees your company's setup screen, or cannot activate the device at all.
-
Device record removed from MDM, endpoint protection and backup consoles
-
Device certificates and VPN profiles revoked
Wipe or destroy
-
Disk encryption confirmed as on before the wipe
On an encrypted device, a factory erase destroys the key, which makes the old data unreadable.
-
Device erased with the built-in factory erase or a dedicated wipe tool
-
Wipe verified: the device boots to the initial setup screen
-
Drives that cannot be wiped are physically destroyed or sent to a certified provider optional
-
Asset labels and stickers with company details removed
Disposal and record
-
Disposal route chosen and recorded: resale, donation, recycling or lease return
-
Disposal or destruction certificate received from the provider optional
-
Asset register updated: status, date, wipe method and disposal route for
{{asset_tag}} -
Finance told so the asset can be written off optional
Checklist as Markdown
Frequently asked questions
How do I securely wipe a laptop before disposal?
Make sure disk encryption was on, then use the built-in erase option: Erase All Content and Settings on a recent Mac, or the reset option with drive cleaning on Windows. Because the encryption key is destroyed, the old data becomes unreadable. For unencrypted or failed drives, use a wipe tool or physical destruction.
What records should I keep when disposing of IT equipment?
At least the asset tag, serial number, last user, wipe method, date, who did it and where the device went. If a provider took it, keep their certificate. These records answer the question "what happened to the laptop with customer data on it?" when someone asks months later.
Do I need to remove a device from MDM before selling it?
Yes. Release it from your enrolment programme and remove it from the MDM, or the next owner may be forced into your company's setup flow. Also sign out of personal and company accounts so that activation locks are released.
Updated