Chain of custody documentation is the record that shows who handled an IT asset, when and where each handoff occurred, and what happened to the device and its data. For ITAD, a defensible record links an identifiable asset from its original location through transport, data sanitization or destruction, and final disposition, with evidence to support each step.
This guide focuses on the paperwork itself: the fields to include, how to complete and review the record, how to retain it, and how to use it during an audit. A custody form is not a substitute for your security policies or legal advice, but it can help you demonstrate that your process was followed.
What should an ITAD custody record show?
Think of the record as a joined-up file, not just a signed pickup sheet. It should connect the asset inventory, custody events, data-destruction evidence, exception notes, and final disposition. If your organization uses a paper form, reference the supporting documents clearly. In a digital system, link those documents to the same case or manifest number.
| Record section | Information to capture |
|---|---|
| Case and asset identity | Unique manifest or case ID; asset tag; manufacturer; model; serial number; device or media type |
| Origin and release | Organization, location, date and time; releasing person; quantity and condition |
| Handoff and transport | From and to parties; date, time and location; signatures or acknowledgments; carrier or tracking reference; container and seal IDs, when used |
| Processing and data outcome | Sanitization or destruction method; processing date and location; result; operator or responsible party; linked certificate |
| Exceptions and destination | Missing items, mismatches or damage; corrective action; final route such as reuse, recycling or destruction |
For data-bearing equipment, identify the storage media as specifically as your inventory and process allow. A server may have multiple drives, and a device serial number alone may not identify each drive processed separately. If you use a separate certificate of destruction or sanitization, link it to the asset or media identifiers and the custody record.
What makes the record defensible?
A useful record lets another person retrace the asset’s journey without guessing. Each handoff should identify who released the equipment, who received it, and when and where the transfer took place. Include signatures, electronic acknowledgments, or other evidence appropriate to your process.
For transport, record the carrier or tracking reference and, when used, container and seal numbers. On receipt, note the quantity and condition and compare them with the pickup inventory. If something is missing, damaged, or inconsistent, record the discrepancy and how it was resolved rather than silently changing the original entry.
Data handling needs its own clear evidence. Record whether storage was wiped using a process aligned with your policy and NIST SP 800-88, or whether the hard drive was physically shredded. Link the result to a certificate of destruction or sanitization that identifies the asset or media, method, date, and responsible party. A certificate is useful evidence, but it does not replace the custody trail leading to the processing event.
How to complete or review a custody record
Use this checklist for each ITAD project. Adapt the fields to your internal policies and the sensitivity of the equipment.
- Assign a case or manifest ID. Use one unique reference across the inventory, handoff records, data-destruction evidence, and disposition documents.
- Identify the equipment. Record asset tags and, where available, manufacturer, model, serial number, and media type. Note removable drives separately when they are inventoried or processed separately.
- Document the release. Enter the pickup location, date and time, releasing person, quantity, and known condition. Keep a copy of the inventory provided to the carrier or service provider.
- Log every transfer. At each handoff, capture the receiving and releasing parties, time, location, and acknowledgment. Add transport, container, or seal details when applicable.
- Reconcile receipt. Compare what arrived with what was released. Note discrepancies, damaged equipment, or opened seals and keep the original record intact.
- Link the data outcome. For each data-bearing asset or media item, record the wipe or shredding outcome and link the related certificate. If processing fails or needs to be repeated, document the exception and its resolution.
- Close the disposition trail. Record the approved next destination, such as reuse, recycling, or destruction. Check that linked evidence is present before closing the case.
The form can be paper-based or digital. For digital records, use access controls and a visible history of changes so corrections do not erase the original entry. Keep timestamps consistent, and make sure attachments can be found by the case ID. The goal is a file that another reviewer can understand without relying on someone’s memory.
How should you handle missing items and exceptions?
A record is more credible when it shows how the team handled a problem. If the received quantity does not match the pickup inventory, pause closure of the case, investigate the difference, and document the steps taken. The same applies if a seal is damaged, a serial number is unreadable, or a wipe cannot be verified.
Record the issue, the person who reviewed it, any corrective action, and the final decision. Depending on your policy and the device, the resolution may involve a second review, reprocessing, physical destruction, or notifying the customer. Don’t treat an exception as resolved until the record shows what happened and who approved the next step.
Retention and audit use
There is no single retention period that applies to every organization or every ITAD record. Set your schedule using the longest applicable requirement from law, contract, customer policy, internal policy, and any relevant certification program. Include the linked evidence, not just the final certificate, and follow a legal hold if records must be preserved.
During an audit, reviewers may ask you to demonstrate that devices were accounted for from release through final disposition. A strong file lets you start with a serial number or asset tag and find the matching handoffs, processing evidence, exception notes, and final route. It can also help you show how your process supports obligations related to HIPAA, PCI DSS, state data breach laws, or contractual security requirements. The document supports your compliance program; it does not guarantee compliance on its own.
Ask your ITAD provider what records you will receive, how assets are reconciled, how data destruction is documented, and how exceptions are reported. For a broader look at collection, processing, and disposition, see Reworx Recycling’s IT asset disposition services.
Putting the documentation into practice
A custody record should match the actual workflow. Before pickup, prepare an inventory and agree on who can release equipment. At handoff, confirm quantities and capture acknowledgments. After processing, reconcile certificates and exceptions before closing the file.
The same care matters whether you are retiring a few laptops or coordinating equipment across several sites. Reworx Recycling is headquartered in Smyrna, Georgia, in metro Atlanta, and serves organizations nationwide across all 50 states. We offer free nationwide pickup and free data destruction, with wiping in a NIST 800-88 style or hard drive shredding and a certificate of destruction.
For collection logistics, tamper-proof drop-off boxes and after-hours or flexible scheduling may help fit your workflow; confirm availability for your location and project. You can also text us for a fast response. Our certified eco-friendly recycling program uses responsible, R2-style downstream processing. Once data requirements are met, suitable refurbished technology can help bridge the digital divide by giving marginalized and vulnerable communities access to technology for education and career readiness. Learn more about data destruction services or call 678-449-0003 to discuss your records and equipment.
Frequently asked questions
What is chain of custody documentation in ITAD?
It is the record of an asset’s handling from release through transport, processing, and final disposition. It connects each handoff and data outcome to identifiable equipment.
What fields should a chain of custody form include?
At minimum, include a unique case or manifest ID, asset identifiers, origin and release details, handoff parties and timestamps, receipt reconciliation, data-processing results, linked certificates, exceptions, and final destination.
Is a certificate of destruction the same as a chain of custody record?
No. A certificate documents a data-destruction or sanitization outcome. The custody record tracks how the asset moved between people and locations and links that outcome to the specific equipment.
How long should we keep ITAD chain of custody records?
Use the longest applicable legal, contractual, customer, internal-policy, and certification requirement. There is no universal retention period for every organization, so document your schedule and include the supporting evidence.
Next step: Before your next equipment pickup, assign a case ID, prepare an asset list, and ask your ITAD provider how each handoff and data-destruction result will be documented.
