ITAD Chain of Custody: What to Record for Every Device (and How to Know if Each Job Made Money)

An IT asset disposition (ITAD) business sells two things at once: a promise that every device a client hands over is accounted for — especially the ones holding data — and a recovery service that has to make money. Both depend on the same record. If you can say where every serial number is, who touched it and what happened to it, you can defend your client in an audit and work out what each job actually earned. This guide sets out what to record per device, the custody hand-offs where records usually break, and a worked job P&L.

1. Why chain of custody matters

Chain of custody is the unbroken, time-stamped record of who held an item, where, and what was done to it, from the moment it leaves the client to its final outcome — resold, harvested for parts, or sent downstream as a material fraction. In ITAD it matters for three reasons.

Your client’s data obligations travel with the device

In South Africa, the Protection of Personal Information Act (POPIA) requires a responsible party to secure the integrity and confidentiality of personal information “in its possession or under its control” with “appropriate, reasonable technical and organisational measures” to prevent loss, unauthorised destruction and unlawful access (section 19). POPIA’s definition of “processing” includes the erasure and destruction of information, so wiping and shredding are processing too.

When a company hands laptops, servers and drives to an ITAD provider, that provider will often be acting as an operator on the client’s behalf. Section 21 requires the responsible party to ensure, through a written contract, that the operator maintains the same section 19 security measures — and requires the operator to notify the responsible party immediately if there are reasonable grounds to believe personal information has been accessed by an unauthorised person. A client’s auditor or information officer will therefore ask you to prove what happened to each data-bearing device. “We processed a pallet” is not an answer; a serial-level record is. (This is general information, not legal advice — your contracts should be reviewed by your own adviser.)

Producers and their schemes want evidence of where e-waste went

South Africa’s Extended Producer Responsibility (EPR) regulations for electrical and electronic equipment, issued under section 18 of the National Environmental Management: Waste Act, were published on 5 November 2020 and came into effect on 5 May 2021, with existing producers required to register by 5 November 2021 (eWASA). The obligations sit with producers and their producer responsibility organisations, but they flow down the chain: an ITAD or e-waste operator that can show tonnages and outcomes per category, per source, is easier to contract with.

Without the record you can’t price the job

The same record that proves custody tells you what came in, what it was worth and what it cost to process. Operators who track custody on paper usually discover, months later, that some job types — the mixed office clear-out, the long-distance collection — lose money every time.

2. The per-device record: what to capture

Every data-bearing device should have its own record from intake. Bulk, non-data material (cables, keyboards, mixed peripherals) can be weighed and tracked as a lot by category. A practical minimum:

3. The six custody hand-offs

Records rarely break in the middle of a process; they break where a device changes hands. Capture an event at each of these points:

1. Client release. The client’s representative signs for the count (and ideally the serial list) leaving their premises.
2. Collection vehicle. Vehicle, driver and seal or crate references; the trip ties the devices to a route and a cost.
3. Receiving. Count reconciled against the collection; devices captured by serial with photos; data-bearing devices segregated into a controlled area.
4. Processing. Test, sanitise or destroy media, grade, dismantle — each step recorded with who did it and when.
5. Storage. Location of each device or lot while it waits for resale or dispatch, with access limited to named roles.
6. Dispatch. Resale order, or outbound load to a downstream processor, weighed and documented, closing the device’s record.

4. Where chains of custody usually break

• Serials captured late. Devices are counted at collection but only serialised days later, after they’ve been moved around the floor. Capture at receiving, not “when we get to it”.
• Destruction evidence kept somewhere else. The wipe log lives in one tool, the shred list on a clipboard, and neither links to the client’s serial list. Keep the evidence against the device record.
• Lots that lose their source. Once boards from three clients go into the same bin, you can no longer say which client’s material went where. Decide which streams must stay separated by job.
• Open access to personal information. Client contact details, collection addresses and any data recovered from devices should be restricted by role, with access logged.
• Collection costs that never reach the job. Fuel, vehicle running cost and crew hours get booked to “transport” overall, so the job looks more profitable than it is.

5. Job P&L: a worked example

Below are two illustrative jobs (figures are examples, not market rates). The structure is what matters: revenue from service fees and recovered value, against labour and processing and the logistics cost of the collection.

Job B looks like normal volume on the weighbridge, but once two collection trips and the crew are attributed to it, it loses money — before any downstream fees for hazardous fractions such as screens or batteries. The fix is commercial, not operational: price that kind of collection by distance and volume, or set a minimum fee. You only see it if logistics and labour land on the job, not on an overhead line.

6. How SynchPlus ONE helps

SynchPlus ONE for e-waste and ITAD keeps the custody record and the money on the same job:

• Serial-level intake — each device captured by serial number or asset tag against the client job, with photos.
• Traceable job handling — the job carries its devices and lots from collection through processing to dispatch, so every outcome traces back to its source.
• P&L per job — client service fees and the resale or commodity value recovered, against labour and processing captured on the job and the collection trip’s logistics cost (fuel, vehicle cost per kilometre, driver).
• POPIA-aligned custody — personal information encrypted, access controlled by role, and an audit trail of who did what.
• Weighbridge, grading and downstream dispatch for bulk fractions on the same platform — see recycling software.

Keep your existing wipe and shred process — record its evidence against each device so the client’s report and the job’s numbers come from one place. It runs on-premise or in the cloud, works offline, and is priced per asset with unlimited users — see pricing.

Frequently asked questions