IT Asset Disposal: What Happens to Old Computers the Right Way

Every laptop eventually reaches the end of its useful life, and what happens in that final week of its service matters more than most IT plans admit. An old computer that leaves your building still holds email archives, client lists, saved passwords and browser sessions. IT asset disposal is the process that turns that machine from a data breach waiting to happen into a documented, value-recovered line item. This guide covers the four things every disposal must deliver: data destroyed so it cannot be recovered, compliance records you can show an auditor, environmental handling you can defend publicly, and where the residual value goes.

If you have read our guide on how often you should audit your IT assets, you know the register only stays honest when entries leave it properly. Disposal is where most asset registers quietly rot: devices vanish into cupboards, or worse, into a bin.

Why disposal is a security event, not a housekeeping task

A hard drive that has seen three years of accounts payable is not empty when you delete the files. Deleted files remain recoverable until the sectors are overwritten or the drive is physically destroyed. Wiping utilities vary; a quick format recovers nothing but hides everything.

The risks are concrete. Data recovered from resold drives has been documented by researchers repeatedly. In one widely cited exercise, researchers bought used drives and recovered enough data to identify previous owners. For a South African business, a recovered mailbox is a POPIA problem, because the Protection of Personal Information Act requires appropriate security safeguards over personal information for as long as you hold it, and disposal sits inside “holding it”.

There is also the audit angle. An asset register that says “disposed” with no evidence trail is a finding waiting to happen. The auditor asks: who authorised it, when did it leave, was the data destroyed, where is the certificate? If the answer is a shrug, your asset data integrity is gone.

The secure disposal process, step by step

1. Identify and authorise. Pull the device from the asset register, confirm its last user, and get written authorisation for disposal. This is the moment most registers lose the plot.
2. Wipe or destroy the storage. For drives you will reuse or resell, use a proper overwrite standard, not a format. For drives that carried sensitive data or cannot be verifiably wiped, physical destruction is the honest answer. The US National Institute of Standards and Technology publishes the reference for media sanitisation, NIST SP 800-88 Rev 1, which most auditors treat as the benchmark (NIST SP 800-88r1).
3. Deregister and decouple. Remove the device from software licence counts, domain membership, MDM enrolment and any monitoring agent. A forgotten device still reporting in is a shadow endpoint nobody patches.
4. Document everything. Serial number, asset tag, date, method of sanitisation, who performed it, certificate from the recycler if one was used. This record is what turns disposal from a claim into a fact.
5. Route the hardware. Refurbish and resell, donate, or recycle. Which route depends on age, condition and what your data policy allows off-site.

Steps 2 and 4 are where businesses cut corners. Both corners are expensive later.

What the law and the planet both expect

Two frameworks apply at once, and good disposal satisfies both.

POPIA expects security safeguards appropriate to the risk, which extends to how you end the life of a device holding personal information. A certificate of destruction from a reputable recycler is the evidence that satisfies both an auditor and, if it ever came to it, the Information Regulator.

The environmental side has harder numbers than most people expect. The Global E-waste Monitor 2024 found that the world generated 62 million tonnes of electronic waste in 2022, and only 22.3% was documented as formally collected and recycled, leaving roughly US$62 billion of recoverable materials unaccounted for (Global E-waste Monitor 2024; also summarised by ITU). Old computers contain copper, aluminium and small amounts of gold and rare earths; dumping them loses those and leaks lead and mercury instead. In South Africa, reputable IT asset disposal companies handle collection, certified data destruction and downstream recycling as one service.

What is on that drive, really?

Walk through a typical 5-year-old business laptop. It holds:

• Browser-saved passwords and session cookies
• Cached email, often the full mailbox with attachments
• Client documents, quotes, contracts and spreadsheets
• VPN certificates or saved remote-access credentials
• Wi-Fi profiles that map your office network
• Chat history from Microsoft Teams or Slack, cached locally

Any one of those is enough for an attacker to start a credible intrusion, a phishing campaign against your staff, or a compliance headache. The old laptop in the cupboard is not dormant, it is a live credential vault waiting for someone to plug it in.

Residual value: where the money goes

Disposal is not all cost. Devices 3 to 5 years old with working components have real resale value through refurbishers. Devices past that still have commodity value in weight and parts. The honest way to think about it:

• Under 3 years: refurbish and resell, or redeploy to a lighter role.
• 3 to 5 years: resale value is modest but real; data destruction certificate still required.
• 5+ years: recycling only. Value is in materials, not function.

Two rules keep this clean. Never sell a device before its storage is verifiably sanitised or destroyed. And never let the resale channel influence the destruction decision, that is how a drive with client data ends up in a Durban flea market.

Common mistakes we see in audits

1. Devices leave the register but not the building. They end up in drawers and storerooms, unpatched and uncounted.
2. Data “wiped” with a format, which hides files without destroying them.
3. No certificate from the recycler, so there is nothing to show for the destruction claim.
4. Disposal happens outside the asset register workflow, so counts drift from reality.
5. Company data found on personal devices that were never in scope at all.

Each of these is cheap to prevent and expensive to explain. The fix is procedural, not technological: make disposal a step in the asset lifecycle with named owners and required evidence. Our guide to what managed IT actually includes shows how this fits into an operating rhythm instead of a one-off cleanup.

Building the policy

A usable disposal policy fits on one page:

• Who authorises disposal (name and role, not a department).
• What happens to storage (wipe standard or destruction, decided by data class).
• What evidence is required (destruction certificate, register update with date and method).
• Which disposal partners are approved, with what certifications.
• What happens to proceeds (who books them, against which asset).

Once the policy exists, the disposal question stops being an incident and becomes an invoice. Devices flow out on schedule, the register stays true, and the auditor’s question has an answer with a document attached.

Frequently asked questions

How do I securely dispose of old computers in South Africa?

Wipe or destroy the storage to a recognised standard, get a certificate of destruction from an approved recycler, remove the device from every licence and domain, and update your asset register with the date and method. For drives that held sensitive client or employee data, physical destruction is the defensible choice. The NIST SP 800-88 standard is the reference most auditors accept for sanitisation methods.

Is deleting files enough before disposing of a hard drive?

No. A standard delete or format removes the index, not the data; the sectors remain readable with recovery tools. Secure disposal requires overwriting to a recognised standard, cryptographic erasure where the drive supports it, or physical destruction. If in doubt, destroy the drive. The data on it is worth more than the drive.

What is a certificate of data destruction?

It is a document from the disposal provider recording each device’s serial number, the sanitisation method used, the date, and the operator. It turns a verbal assurance into an auditable fact. Keep certificates with your IT compliance records; under POPIA, they are your evidence that security safeguards extended to end-of-life disposal.

Can old company computers be donated to schools or charities?

Yes, and it is a good outcome, but only after the storage is sanitised or replaced and the device is removed from your register. Never donate a working machine with its original drive intact. A machine that leaks one client database does more damage to your reputation than a hundred donated machines do good.

How much value is left in end-of-life IT equipment?

Realistically: 3-year-old laptops resell at a meaningful fraction of their original price through refurbishers; 5-year-old machines carry modest resale or parts value; older equipment is worth its weight in recoverable materials. Globally, the UN estimates about US$62 billion in recoverable resources went uncollected with e-waste in 2022, so the material value is real even when the resale value is not.

An asset’s life does not end when it stops being useful, it ends when it leaves your control safely. Disposal is the last step of asset management and the first test of whether your register can be trusted. Get the destruction right, keep the certificates, and the cupboard full of old laptops stops being a liability and becomes a clean line on the audit.