A chain of custody for returned laptops is an unbroken, timestamped record of who held each machine and what they did with it, logged against the serial number. A courier tracking number is not one. It proves a parcel moved, not which device was inside or who opened it.
TL;DR
- The unit of record is the serial number, never the shipment.
- Every handoff needs a named party on both sides, not just a scan event.
- The destruction certificate is the final entry, not the whole document.
- The gap that trips people is between collection and arrival at the warehouse.
- Scope it to devices that held regulated data, not to everything.
- Ask a vendor for a real redacted record, not a template.
When you do not need this
Formal custody records cost effort, and plenty of teams build them before anything requires it. Four honest stages.
Manual is fine. A handful of machines a year, no regulated data, no customers asking questions. A line in a spreadsheet saying the laptop came back and was wiped is proportionate. Do not gold plate this.
Friction appears. You are shipping between countries, or a third party now touches the device. The spreadsheet still exists but nobody is certain it is complete, and two people maintain different versions.
Liability appears. A customer contract or a security questionnaire asks how you handle decommissioned media. Now the record needs to be producible on demand, by somebody who was not involved.
The edge case. A device goes missing and you need to show exactly where the trail stops. This is the only stage where the record earns its keep, and it is the one you cannot prepare for retrospectively.
What a chain of custody for returned laptops contains
Six fields per entry. Fewer than six and the record will not answer the question it exists for.
- Serial number. The device identifier, captured at the first handoff rather than at the warehouse. If it is captured on arrival, the first leg is undocumented.
- Timestamp. Date and time of the transfer, not the date somebody typed it up.
- Releasing party. A named person or organisation, not “collected”.
- Receiving party. Same requirement, and this is where partner networks tend to go vague.
- Location. Where the handoff physically happened.
- Condition. Observed state on receipt, including whether seals were intact.
The sanitisation entry carries more. It should name the method and the standard applied. Most auditors recognise NIST Special Publication 800-88, which distinguishes clearing from purging from physical destruction, and the distinction matters because only one of the three survives a determined recovery attempt.
If your organisation holds or is pursuing certification, the governing requirement is usually asset handling under ISO/IEC 27001, which expects documented handling of media through to disposal. The custody record is how you evidence that clause rather than assert it.
The four places the record breaks
The first mile. The employee hands the laptop to a courier. No serial number is captured, because the courier scans a label on a box. Everything downstream is inference. This is the commonest break and the hardest to fix after the fact.
The partner handoff. Your vendor operates directly in some markets and through partners in others. The partner’s internal transfers may not appear in the record you are shown. Ask explicitly whether partner legs are logged.
Storage. A machine sits in a warehouse for eleven weeks waiting on a decision. Most records show arrival and departure with nothing in between, which is defensible only if access to the storage area is itself controlled and logged.
The reassignment. A returned laptop is wiped and sent to a new hire. Many records end at the wipe, so the device re-enters your estate with no link between its old identity and its new one. Your asset register then holds two histories for one machine.
Five questions to put to a vendor
At what point is the serial number first recorded? If the answer is the warehouse, the first leg is undocumented and you should know that before signing.
Are partner handoffs in the record? In markets served indirectly, ask to see a real example rather than a description.
Can you produce a record for a single serial number on request? Some systems can only export everything, which is useless in an audit with a narrow scope.
What standard does the wipe follow, and does the certificate name the serial? A certificate covering a batch is weaker than one naming the device.
How long is the record retained? Shorter than your customer contracts require is a problem you will discover at renewal.
Who provides this, and where each one struggles
Named honestly, including the one we have an interest in.
Your own process. Best when volume is low and everything happens in one country. It struggles the moment a third party touches the device, because you are now documenting something you did not witness.
Certified ITAD firms. Best for the destruction end. Their custody documentation is usually the strongest in the market because certification demands it. They struggle on the collection leg, especially internationally, where they often sub-contract.
Equipment lifecycle platforms such as Firstbase, Workwize, GroWrk and allwhere. Best for covering collection through storage in one system. They struggle on evidentiary depth: a dashboard showing status is not the same as an exportable custody record, and the difference only surfaces under audit.
Deel IT and Rippling. Best if device handling is already bundled into your employment stack. They struggle as a source of audit evidence, because logistics is a secondary product for both.
RemoAsset. Disclosure: RemoAsset is owned by the same people who publish this site. It runs collection, wiping, storage and reassignment across 80 or more countries, which means the handoffs sit inside one provider rather than across three. Where it struggles: it is a logistics and lifecycle service rather than a certified destruction specialist, so if your requirement is certified physical destruction with the accompanying accreditation, that is a different purchase and worth separating in your shortlist. The scope of its retrieval and wiping service is the thing to check against your own evidence requirements.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| No regulated data, one country | Under 50 | No IT function | Remembering to log anything | A dated spreadsheet row per device |
| Customer security questionnaires | 50 to 200 | One ops owner | Cannot produce evidence on demand | Six-field record, captured at pickup |
| Pursuing certification | Any | Compliance owner | Clause requires documented disposal | Vendor that exports per-serial records |
| Many countries, partner networks | 200 plus | Small IT team | Gaps in indirectly served markets | One provider across the whole path |
| Physical destruction required | Any | Regulated industry | Wiping is not sufficient | Certified ITAD, separate from collection |
| High reuse of returned machines | 200 plus | Dedicated IT | Device history resets on reissue | Record that survives reassignment |
What a missing link costs
A gap in the record is not a paperwork problem. It is the inability to answer a direct question at the moment somebody important is asking it, and the honest answer in that moment is that you do not know.
The expensive version is a lost device holding customer data where the trail stops at a courier scan. You cannot show it was wiped, because it was not. You cannot show who had it, because nobody recorded the handoff. Whether that becomes a notifiable event depends on your jurisdiction and your data, and the point is that the decision gets made without the facts you would want.
The quieter cost is deal friction. Security questionnaires now routinely ask how decommissioned media is handled, and an answer that describes intent rather than evidence slows a sale. The asymmetry is unpleasant: building the record costs very little, and not having it costs whatever the deal was worth.
So the question is not whether your process is careful. It is whether you could prove it was, to somebody who was not there and has no reason to take your word for it.
When a spreadsheet stops being evidence
A spreadsheet is a perfectly good custody record right up to the point where somebody can edit it without leaving a trace. That is the real threshold, and it has nothing to do with company size.
Three signals usually arrive together. A third party now handles devices you are accountable for. A customer asks for evidence rather than a description. And the person who maintained the spreadsheet has left, so nobody is certain the recent rows are complete.
At that point the choice is between hardening your own process and buying one where the record is generated as a side effect of the work. The second is usually cheaper, because the first means documenting handoffs you did not witness. Looking at the full laptop lifecycle in one place is worth doing before you build custody tracking yourself, if only to see how much of the record falls out of the process for free.
Related reading
- What a certificate of data destruction should say
- What data destruction costs per device
- The ITAD vendor checklist
- Writing a retrieval SLA vendors will sign
- The IT offboarding checklist
Frequently Asked Questions
What is a chain of custody for returned laptops?
An unbroken record of who held a specific machine, when, and what they did with it, from the moment it leaves the former employee to the moment it is wiped, stored or destroyed. Each handoff is logged against the serial number, with a named party on both sides. If any link is missing, the record does not establish anything.
Is a courier tracking number enough?
No. A tracking number proves a parcel moved between two addresses. It does not prove which laptop was inside it, that nobody opened it, or what happened after it arrived. It is evidence of shipping, not of custody, and the two are routinely confused in vendor documentation.
What should each custody entry contain?
The serial number, a timestamp, the party releasing the device, the party receiving it, the physical location and the condition on arrival. Anything less and you cannot answer the only question that matters later, which is who had the machine during the window you are being asked about.
When does this actually get tested?
During a security questionnaire, a customer audit, a funding diligence process or an incident. All four arrive without warning and all four ask the same thing: show us what happened to this device. A record assembled afterwards from emails is not the same as one captured at the time.
How does this relate to a destruction certificate?
The certificate is the last entry, not the whole record. It states that a serial number was sanitised to a given standard on a given date. It says nothing about the three weeks between the employee handing the laptop over and the wipe happening, which is usually the window somebody asks about.
What should I ask a vendor for?
A sample record for a real past collection with the client details removed. Not a template, not a screenshot of a dashboard. A real one shows you the gaps: whether handoffs between their partners are logged, and whether the serial number is captured at pickup or only at the warehouse.
Do I need this for every device?
No. Scope it to machines that held regulated or customer data. A shared meeting room laptop does not need the same treatment as a finance manager’s. Deciding the scope in advance is cheaper than applying the strictest standard to everything you own.
