ITAD chain of custody is the unbroken, documented trail that follows every IT asset from your office to final wipe or destruction. Every data-bearing device is labelled with its job number at collection, transported on live-tracked vehicles, logged by serial number at the processing facility, and matched to a certificate. If any link in that chain is missing, you cannot prove your data was destroyed.
Key facts at a glance
- Chain of custody tracks each asset through four links: a signed collection record, tracked transport, recorded processing, and a serial-matched certificate.
- Under UK GDPR, liability for data on disposed equipment stays with your business — not your contractor.
- An NHS trust was fined £325,000 after a disposal contractor removed drives that were later sold online, unwiped.
- On collection day, demand a signed record of what was collected, job-number labels on every data-bearing device, and driver photo ID.
- Certificates should arrive after processing, never on the doorstep at handover.
What does chain of custody mean in ITAD?
Chain of custody means every IT asset is individually recorded at each stage between your building and its final destruction or resale. The idea comes from evidence handling. At any moment, you can name who held an item, where it was, and what was done to it. In ITAD, the chain has four links. Everything collected is recorded on a signed collection record, with every data-bearing device labelled with the job number. It travels on a live-tracked vehicle to the processing facility, where it is logged by its serial number. Its wipe or destruction is recorded against that serial. Finally, a certificate confirms the result for that exact device. This post is a deep dive into one element of the wider IT asset disposal process. The table below shows what each link should produce on paper.
| Stage | What is recorded | What you should receive |
|---|---|---|
| 1. Collection record | A signed count of everything collected, with every data-bearing device labelled with the job number | Your copy of the signed collection record |
| 2. Tracked transport | Vehicle and driver identity, with the vehicle live-tracked door to door | Driver photo ID matching the details you were given in advance |
| 3. Processing | Serial-level reconciliation against the collection record, then wipe or destruction method, date and operator per serial | A line entry in the asset report |
| 4. Certification | Pass or fail result matched to each serial | Serial-matched certificate of destruction |
The final link is only as strong as the three before it. Our guide to certificates of destruction covers what that last document must contain.
Why does chain of custody matter under UK GDPR?
Under UK GDPR, responsibility for personal data stays with your business even after a contractor drives away with your equipment. The law treats you as the data controller. You may only use processors that give "sufficient guarantees" they will protect the data you hand over. If your disposal partner loses or leaks that data, the ICO can hold you liable, with fines of up to £17.5 million or 4 per cent of annual worldwide turnover. Chain of custody records are how you prove you met that duty. A signed collection record shows what left your building. A serial-matched report shows what happened to each drive. Without those documents, secure data destruction is just a claim your supplier made. A claim is not a defence.
What happened when an NHS trust lost control of its hard drives?
The best-known UK example of a broken ITAD chain of custody cost an NHS trust £325,000. In 2010, Brighton and Sussex University Hospitals NHS Trust arranged for around 1,000 hard drives to be destroyed. The work was carried out by an individual engaged through the trust's IT services provider, working unsupervised. Instead of destroying every drive, he removed 252 of them from the hospital. Four were later sold on an online auction site and bought by a data recovery company. They held highly sensitive records, including details of patients receiving HIV treatment. In 2012 the Information Commissioner's Office fined the trust £325,000, its largest penalty at that time, under the Data Protection Act 1998. Destruction of the missing drives had never been certified. UK GDPR carries the same controller-liability principle today, with far higher maximum fines.
What should happen on collection day?
Collection day is where most chains of custody either hold or break. The handover takes minutes, but the paperwork created in those minutes is what an auditor or regulator will ask for years later. A compliant handover follows five steps:
- Identity check. The driver presents photo ID, and the vehicle matches the details you were given in advance.
- Signed record. Everything collected is counted and recorded on a signed collection record in front of your staff, with full serial-level reconciliation completed at the processing facility.
- Tracked transport. Equipment leaves on a live-tracked vehicle, so its location is known door to door. You keep a copy of the signed record before it departs.
- Labelled devices. Every data-bearing device should be labelled with the job reference before it leaves your site, so nothing can be mixed up in transit.
- Certificate timing. Certificates follow after processing, usually within days. A certificate handed over at the kerbside, before any wiping has happened, proves nothing.
If a collector skips any of these steps, your chain of custody is already broken before the van reaches the road.
How do you check an ITAD collector is legitimate?
Five checks, none of which take more than a few minutes, will filter out almost every rogue collector. Run them before you hand over a single device:
- Waste Carrier registration. Ask for the registration number and check it on the Environment Agency's public register. No registration, no collection.
- Information security certification. Ask for their ISO 27001 certificate. Check it is current and that its scope covers IT asset disposal and data destruction, not just an office function.
- Named destruction standards. Ask which standards they work to. Look for NIST 800-88 for data wiping and HMG IS5 (Enhanced) for physical destruction. Vague answers such as "military grade" are a warning sign.
- Serial-level reporting. Ask to see a sample collection record, asset report and certificate. The asset report and certificate should list individual serial numbers, not just totals.
- Who does the work. Confirm whether they use their own staff, vehicles and facility, or subcontractors. Every subcontracted link adds a party you have never vetted.
What do auditors look for in ITAD records?
Auditors test one thing above all: can you trace any single asset from your register to a named person who destroyed its data? The standard method is sampling. An auditor picks a serial number from your disposal records and asks for its full story. You should be able to show the signed collection record it left under, the wipe or destruction method applied, the date, the asset report line recording the result, and the responsible person who signed it off. They will also reconcile totals. The number of devices in your asset register marked as disposed should match the collection records and asset reports, which should match the certificates. Gaps between those three numbers are findings. Keep collection records, asset reports and certificates filed together per collection, with a named owner inside your business, so the trail can be walked in minutes rather than days.
What are the red flags of a broken chain of custody?
Most chain of custody failures announce themselves early, if you know what to look for. Treat any of the following as a reason to stop and ask questions:
- Cash-for-scrap collectors who offer to "take it all away" with no paperwork.
- Blanket certificates that state a quantity but list no serial numbers.
- Certificates issued on collection day, before any processing has taken place.
- Loose, unlabelled loading of drives or devices into an untracked van.
- No Waste Carrier registration number on quotes, emails or vehicles.
- Refusal to let you visit the processing facility or witness destruction.
- No clear answer on where resold equipment goes or how data is removed first.
- Long, unexplained gaps between collection and certification.
None of these guarantees wrongdoing. Each one, though, is a link your auditor cannot verify, and that is the point of the chain.
Who is responsible for the chain of custody?
Responsibility for chain of custody is shared, but the legal risk sits with you. Your ITAD provider builds the chain. They label the devices, track the vehicles, record the processing against each serial and issue the certificates. As data controller, your job is to demand that chain, check it, and keep it. That means naming a responsible person inside your business — often an IT manager, facilities lead or data protection officer — who signs the collection record, receives the certificates and reconciles them against your asset register. It also means writing the requirements into your contract before the first collection: serial-level reconciliation, tracked transport, named destruction standards and certificate timescales. A provider that resists putting those terms in writing is telling you something. Regulators do not accept "we assumed the contractor handled it" as a defence, and neither will your auditor.
What does a compliant chain of custody look like in practice?
At Innovent, chain of custody is built into every collection rather than offered as an extra. You receive a signed count of everything collected before it leaves your building, every data-bearing device is labelled with its job number so nothing gets mixed up in transit, and equipment travels on our own vehicles with C-Track UK live tracking, driven by our own vetted employees. Processing happens at our solar-powered facility in Ellesmere Port, where drives are wiped to NIST 800-88 or destroyed to HMG IS5 (Enhanced), and every serial is matched to a certificate of destruction and asset report. We are ISO 27001 certified and a registered Waste Carrier, and we operate a zero landfill policy. Collection is free nationwide, whether that is a single office clearance or recurring computer recycling in Manchester. Resale-grade equipment can earn rebates through IT equipment buyback, with the same serial-level tracking. To arrange a collection, book a collection online or call 0151 355 5482.
ITAD chain of custody FAQs
What documents should I receive after an ITAD collection?
Two sets. On the day itself: a signed collection record confirming everything that was collected, with each data-bearing device labelled with the job number. After processing: a serial-matched certificate of destruction and an asset report showing the method, date and result for each data-bearing device. File both sets together.
How long should we keep chain of custody records?
UK GDPR sets no fixed retention period, but the accountability principle means you must be able to evidence compliance on demand. Many UK businesses keep disposal records for six years, in line with common contractual limitation periods. Keep collection records, asset reports and certificates together per collection.
Does chain of custody apply to leased equipment?
Yes. Data protection duties follow the data, not the ownership of the hardware. Before leased devices go back to the lessor, the data on them must be wiped and that wipe documented against each serial number. A rushed lease return with no wipe records is a common audit failure.
Can a small collection still have a full chain of custody?
Yes. Serial-level tracking works the same way for five laptops as it does for five hundred. A reputable provider will count, label, track and certify a small collection without charging extra for the paperwork. If a collector says your job is too small to document, choose another collector.
What happens if a device goes missing in transit?
Job-number labelling and the signed collection record exist so that any loss is detectable and provable. Every data-bearing device is labelled at collection, the vehicle is tracked live door to door, and every serial is reconciled against the signed record at the facility. If that reconciliation does not match, the provider should notify you immediately and investigate.
Is on-site destruction better for chain of custody?
On-site destruction removes the transport link, and some high-security environments require it. For most businesses, job-number labelling, live-tracked vehicles and serial-matched certificates provide equivalent assurance at lower cost. What matters is not where destruction happens but whether every step is recorded and verifiable.