When a server or office PC reaches the end of its useful life, it is tempting to unplug it, stack it in a storage room and deal with it later. A retired machine may still hold business records, credentials or other sensitive information. Disposing of it properly means two separate jobs: making the data unrecoverable and getting rid of the hardware responsibly.
This guide walks through both, drawing on the U.S. National Institute of Standards and Technology (NIST) guidance on media sanitization, Federal Trade Commission (FTC) disposal guidance and the Environmental Protection Agency's (EPA) recommendations on electronics recycling. It is general information, not legal advice; organizations with specific regulatory obligations should confirm requirements with their compliance advisor.
Step 1: Take inventory
Before anything leaves the building, record what you are retiring. For each device, note the make, model and serial number, the drives it contains, and the kind of data it held. Servers can contain multiple drives or removable media, so check the hardware configuration rather than assuming there is only one storage device. Also consider equipment such as network-attached storage units, copiers and multifunction printers with internal storage, and mobile devices if they are part of the retirement batch.
This inventory becomes the basis for your disposal records later.
Step 2: Decide whether the hardware will be reused
NIST's guidance treats reuse as a key decision point. If a device will be redeployed internally, donated, resold or returned at the end of a lease, the drives need a sanitization method that leaves them usable. If the device is damaged or obsolete and will never be reused, NIST notes that destroying the media can be the simplest and most cost-effective option.
NIST also highlights control of media as a factor: once a device leaves your organization (returned to a lessor, donated, resold or sent to a recycler), you no longer control who can attempt to read it, so the sanitization decision should account for that.
Step 3: Choose a sanitization method: clear, purge or destroy
NIST Special Publication 800-88, Guidelines for Media Sanitization, defines three methods. Revision 2, published in September 2025, superseded the 2014 Revision 1.
Clear
Clear applies logical techniques to sanitize data in all user-addressable storage locations, protecting against simple, non-invasive recovery using the same interface available to the user. In practice this means overwriting the drive with new data through normal read and write commands, or using a factory-reset option when overwriting is not supported. The device remains usable.
NIST cautions that overwriting is not reliable on flash-based storage such as SSDs. These devices use spare cells and wear leveling, so the host cannot directly address every location where data was stored. The publication also notes that old multi-pass overwrite routines, once common for hard drives, achieve very little confidentiality protection on SSDs with overprovisioning.
Purge
Purge uses physical or logical techniques that make recovery of the target data infeasible even with state-of-the-art laboratory techniques, while potentially leaving the device reusable. NIST recommends using purge instead of clear when possible. Logical purge techniques include dedicated, standardized device sanitize commands (overwrite, block erase) and cryptographic erase, which sanitizes the encryption keys protecting the data so the encrypted contents can no longer be decrypted. NIST notes that cryptographic erase can be very fast but depends on the quality of the device's encryption and meeting certain preconditions.
Destroy
Destroy makes data recovery infeasible with state-of-the-art laboratory techniques and leaves the device unable to store data again. NIST lists disintegration, incineration, melting, pulverizing and shredding as the techniques commonly associated with destruction. It warns that partial damage, such as bending, cutting or drilling a hole through a drive, may leave portions of the media readable in a lab.
Degaussing vs. shredding
Degaussing uses a strong magnetic field to erase magnetic media. It is often mentioned alongside shredding, but the two are not interchangeable:
- Degaussing only works on magnetic media. NIST states that degaussing should not be used on non-magnetic storage such as flash and SSDs. A degausser run against an SSD can appear to complete successfully while sanitizing nothing.
- Degaussing must be matched to the drive. Modern high-coercivity magnetic drives may require more magnetic force than many existing degaussers produce. NIST classifies degaussing as a possible purge technique for magnetic media when properly matched, not as a destroy technique.
- Shredding is a destroy technique, applicable to most media types. However, NIST cautions that as data density and component hardness increase, some destructive techniques become less effective, and it advises avoiding pulverizing and shredding of storage devices for anything but the lowest security categories of data. For more sensitive data, ask your vendor which of the other listed destroy techniques, or which purge technique, they use and how they verify it.
For a typical business fleet that mixes older hard drives and newer SSDs, this means a single method rarely fits every device. Match the technique to the media.
Step 4: Verify and document
Sanitization is not finished until it is checked. NIST describes verification as confirming the chosen technique actually worked, and gives examples of how it can fail: degaussing an SSD, using unapproved or uncalibrated tools, or relying on simple overwrites (a clear technique) on a drive that uses overprovisioning, which can leave a substantial amount of user data unchanged.
NIST says a certificate of sanitization should be completed for each sanitized device, per the organization's policies. According to the publication, the record should include at least the manufacturer, model, serial number, any internal asset number, media type, sanitization method (clear, purge or destroy), technique (for example overwrite, block erase or cryptographic erase), the tool and version used, the verification method, and the name, title, date, location, contact details and signature of the person who performed verification. NIST includes a sample form in Appendix C of SP 800-88.
If you use an outside vendor, ask for this documentation for every device, matched to serial numbers.
Step 5: Check legal disposal obligations
Some businesses have specific legal duties when disposing of records. The FTC's Disposal Rule, in effect since June 1, 2005, applies to anyone who uses consumer reports for a business purpose, including employers, landlords, lenders, insurers and auto dealers. It requires reasonable measures to protect against unauthorized access to that information when disposing of it. For electronic media, the FTC gives examples such as policies to destroy or erase files so the information cannot be read or reconstructed, and hiring a disposal contractor after due diligence, for example checking references, reviewing an independent audit or requiring certification by a recognized trade association.
Other industries have their own rules, so confirm what applies to your business.
Step 6: Recycle through a certified recycler
Once the data is dealt with, the hardware itself should not go in the trash. The EPA recommends that businesses use certified electronics recyclers, meaning recyclers that have demonstrated, through an accredited independent auditor, that they meet specific standards. EPA names two accredited certification standards in the United States: the Responsible Recycling (R2) standard and the e-Stewards standard. Both evaluate environmental, worker health and security practices and call for data destruction. The R2 and e-Stewards websites list certified recyclers and their services.
EPA also advises removing batteries before recycling, since they may need to be recycled separately, and notes that lithium-ion batteries should not go in household trash or recycling bins.
A quick checklist
- Inventory every device and drive, including printers, NAS units and phones.
- Decide which devices will be reused and which will be retired for good.
- Pick clear, purge or destroy per device, matched to the media type (magnetic vs. flash).
- Verify the result and complete a certificate of sanitization per device.
- Confirm any legal disposal obligations, such as the FTC Disposal Rule.
- Hand hardware to an R2 or e-Stewards certified recycler and keep the paperwork.
Bottom line
Disposing of old servers and computers safely is a records exercise as much as a hardware one. Know what you have, choose a sanitization method that fits each drive, prove it worked, and use a certified recycler for what is left. That sequence protects your data, your customers and the environment.
