A good e-waste policy is a short document that answers five questions: what it covers, who owns each step, how data gets destroyed, who is allowed to take the equipment, and what proof you keep. Below is a section-by-section template you can paste into your own document and edit, with the reasoning behind each clause so you can defend it to an auditor.
This template is written for US businesses and organizations. There is no single federal law that tells every company how to recycle electronics, so the policy has to point to your state’s rules and to the federal data-sanitization standard you choose to follow.
TL;DR
- Write the policy around the full asset lifecycle: acquisition, inventory, decommissioning, sanitization, hand-off and proof of disposal.
- Use NIST SP 800-88 Rev. 2 as the reference for media destruction, and treat sanitization as a program with owners and records, not a one-off task.
- Name your state environmental agency in the policy. Rules differ by state, and the business that generated the waste usually keeps responsibility for what happens downstream.
- Require vendor due diligence, itemized records and a certificate for every batch. No certificate, no closed ticket.
- Review the policy once a year and after any change in state law, vendor or hardware mix.
Table of Contents
- Why a written policy beats a good intention
- The template, section by section
- Adapting the template to your situation
- From policy to practice: a rollout checklist
- Our perspective: policies fail at the hand-off
- How we can support your policy
- FAQ
- Sources
Why a written policy beats a good intention
Most companies already dispose of old equipment somehow. The risk lives in the gaps: a laptop stored in a closet for three years, a server rack pulled by facilities without telling IT, a box of drives handed to whoever offered a free pickup.
A written policy closes those gaps by making someone accountable at each step. NIST makes the same point in its media sanitization guidance: sanitization should be run as a program, tracking media from decommissioning to verified destruction, rather than a single technical decision about which shredder to buy.
The policy also has to reflect how little the law hands you. According to an EPA overview of e-waste policy in the US, there is no unified federal law mandating e-waste recycling. Instead, 25 states have adopted statewide e-waste recycling laws, and 15 of them explicitly ban certain electronics from landfills. Your policy fills in what the patchwork leaves open.
The template, section by section
Copy the headings below into your own document. Text in [brackets] is for you to fill in.
1. Purpose and scope
This policy sets the rules for retiring, sanitizing, recycling, reselling and disposing of electronic equipment owned or managed by [Company Name]. It protects confidential data, meets environmental obligations in [State(s)] and keeps a verifiable record of every asset from purchase to final disposition.
Then list what is in scope. Be specific, because the vague category “IT equipment” is where assets go missing:
- Computers, laptops, tablets and phones, including personal devices used for work under a BYOD arrangement
- Servers, storage arrays and network hardware
- Hard drives, SSDs, USB drives, backup tapes and other storage media
- Printers, copiers and multifunction devices that contain storage
- Batteries, including laptop and UPS batteries
- Peripherals, displays, cabling and, where relevant, solar panels and other facility equipment
Also state what is out of scope, for example consumer e-waste collected from the public, which carries different rules (see the batteries section below).
2. Roles and responsibilities
An unowned policy is a decorative policy. Name roles, not people, so the document survives staff changes.
| Role | Responsibility |
|---|---|
| Policy owner (CIO, IT director or head of security) | Approves the policy, reviews it annually, signs off on vendors |
| IT asset manager | Maintains the inventory, schedules retirements, files certificates |
| Department managers | Report equipment as surplus, never dispose of it themselves |
| Facilities | Controls secure storage and physical access to retired equipment |
| Legal or compliance | Tracks state and federal requirements, handles retention periods |
| Employees | Return equipment, do not store or discard devices on their own |
The principle of “polluter pays” sits behind this table. A policy analysis from the South African government on its national WEEE policy is built on producer responsibility, and the same logic works inside a company: financial and operational responsibility for an asset should be assigned for its whole life, so nothing is abandoned or disposed of illegally. That is a South African policy, not a US requirement, but the internal principle transfers well.
3. Asset inventory and tracking
Require that every device with storage is recorded at purchase with a serial number, asset tag, assigned user, location and data classification. Disposal can only be proven if the asset existed on paper first.
Sample clause:
No asset may be removed from service, moved off site or released to a vendor unless it appears in the asset inventory and its status has been updated to “pending retirement.”
4. Decommissioning and chain of custody
This section covers the time between “no longer needed” and “handed to a vendor,” which is when most losses happen.
- The department submits a retirement request to the IT asset manager.
- IT updates the inventory status and removes the device from the network and any management tools.
- The device goes to a locked, access-controlled storage area. It is never left in hallways, loading docks or unattended carts.
- Each transfer is logged: who handed it over, who received it, date and time.
- Devices holding regulated data are flagged for witnessed or on-site destruction.
Keep the storage period short. A sensible clause sets a maximum, such as [30] days from retirement request to hand-off, with exceptions approved by the policy owner.
5. Media destruction policy
This is the section people search for most, and it is the one where the standard changed recently. NIST published SP 800-88 Revision 2 in September 2025. According to the NIST publication page, the revision helps organizations set up a media sanitization program with suitable methods and controls. It moves away from a list of hands-on techniques and toward governance, vendor validation and risk-based decisions.
That shift should show in your wording. Instead of “drives must be shredded,” define a decision rule:
Storage media is sanitized according to NIST SP 800-88 Rev. 2. The method (clear, purge or destroy) is chosen by the data classification of the media and whether the device will leave [Company Name]’s control or be reused internally. Media that held [Confidential/Restricted] data and will leave our control is physically destroyed or purged with verification. Every sanitization is documented and verified.
A simple matrix helps staff apply it:
| Situation | Typical approach | Proof to retain |
|---|---|---|
| Device reassigned inside the company, low-sensitivity data | Clear (overwrite) with verification | Sanitization log entry |
| Device resold or donated | Purge or cryptographic erase where supported, with verification | Report per device, serial numbers |
| Failed drive, or media holding regulated or highly confidential data | Physical destruction | Certificate of destruction with serial numbers |
| Legacy media (tapes, optical, USB) | Physical destruction | Certificate, batch count |
Treat the matrix as a starting point and let your security team set the final rule. Revision 2 also expanded guidance on cryptographic erase, which is useful for modern encrypted drives, as the NIST announcement describes. If you want a plain-language walkthrough of the standard, we cover it in our NIST data destruction guide.
Two more clauses belong here. First, state where destruction happens: on site, witnessed, or off site under chain of custody. Our witnessed hard drive destruction requirements page lays out what procurement should ask for. Second, state that destruction is never left to the end user. Employees do not drill, smash or “wipe” drives on their own.
6. Reuse, resale and recovery
Retired equipment often has value. The policy should say who decides whether a device is resold, redeployed, harvested for parts or recycled, and require sanitization before any of those paths. Recovered value should be credited to a named budget line, so IT has a reason to route equipment properly instead of dumping it. If your team keeps parts for repairs, a guide on reusing computer parts is worth a look before you decide what to scrap, though in any case the drive inside must go through section 5 first.
7. Vendor selection and due diligence
This is where policies are weakest, and it is the clause that protects you if a vendor fails. The EPA’s Pacific Southwest office states plainly in its eCycling FAQ that the agency does not certify recyclers, so the burden of checking falls on you. Treat the policy as the place to define “checked.”
Require every e-waste and ITAD vendor to:
- Hold the permits and registrations your state requires, with copies on file (for California, that includes registration with the Department of Toxic Substances Control)
- Provide a current third-party certification relevant to electronics recycling and data security, verified by IT, not just accepted from a brochure
- Disclose downstream processors and confirm that no equipment is sent to landfill or exported without approval
- Carry appropriate insurance
- Permit an on-site audit, and be audited by you or a designee [every 2 years] or after any incident
- Issue itemized documentation for every pickup
The stakes are real. In one enforcement case, EPA described how a Kentucky operator took in far more electronics than he could process and sent crushed CRTs to a landfill without the license to handle them, ending in a 36-month prison sentence. The customers who handed over their equipment were not the ones sentenced, but none of them wanted their name attached to that pile. Under many state laws and general liability principles, responsibility for downstream compliance stays with the original generator, which is why the due-diligence clause earns its place.
For a longer checklist, see our guide to responsible IT disposal.
8. Batteries and special items
Laptop, UPS and device batteries need their own clause because they are a fire and hazardous waste concern. Say that batteries are removed where practical, stored in non-conductive, labeled containers away from heat, and sent only to recyclers that accept them. The EPA recommends managing easily removable batteries as universal waste and recycling them with a certified recycler. Our laptop battery recycling page covers the practical side.
If your organization also collects electronics or batteries from the public (a retailer take-back program, for instance), add two rules from the same EPA tip sheet, last updated in May 2026:
- Collected items must go either through an agreement with a permitted household hazardous waste facility or through a licensed hazardous waste transporter.
- Keep collected household e-waste physically separate from hazardous waste your own operations generate, because mixing them can cost the collected items their regulatory exemptions.
9. Regulatory compliance and reporting
This clause should name the specific agency in each state where you operate, and assign legal or compliance to track changes. The EPA overview notes that e-waste falls under federal hazardous waste rules (RCRA) only when it meets toxicity or listing criteria, which produces case-by-case interpretation. Do not try to restate every rule in the policy. Point to a maintained list instead. We keep two for reference: electronic disposal regulations for business compliance and e-waste reporting requirements.
Add a line for sector rules too. If you handle health, financial or student data, your data protection obligations apply to the drive even after it is retired.
10. Records and certificates
Specify what you keep, who keeps it and for how long. A solid record set per disposal batch includes:
- The retirement request and approval
- The chain-of-custody log
- A list of assets by serial number matched to the inventory
- A certificate of destruction or recycling from the vendor, dated and signed
- Weight or item-count receipts
- The sanitization verification report, where applicable
Set the retention period with your legal team, based on your industry and state requirements. Many companies align it with their audit cycle.
11. Exceptions, violations and review
Close with three short clauses: exceptions need written approval from the policy owner; violations are handled under the company’s disciplinary policy; and the document is reviewed [annually] and after any change in law, vendor or hardware.
Adapting the template to your situation
The outline above fits most mid-size organizations. A few adjustments are worth making.
Small business. Merge roles: one person may be owner, asset manager and approver. Keep sections 5, 7 and 10 in full, since those protect you most.
Multi-state company. Add an appendix with one row per state: the agency, applicable e-waste rules, any landfill ban and the approved vendor. Our recycling regulations overview for 2026 can seed that table.
Remote workforce. Add a clause covering devices at home: who pays for return shipping, how drives are tracked in transit, and a deadline after separation or upgrade.
Regulated data. Move to witnessed or on-site destruction by default, and require serial-number-level certificates.
From policy to practice: a rollout checklist
- Inventory what you hold today, including the closet and the warehouse.
- Assign the policy owner and approve the document.
- Vet and select vendors against section 7, and file their paperwork.
- Train IT, facilities and department managers in a 20-minute session.
- Run a pilot retirement batch and review the records for gaps.
- Schedule the annual review.
For the sequencing of an actual disposal project, our electronics disposal planning steps guide goes deeper.
Our perspective: policies fail at the hand-off
We see the same pattern in the businesses we work with. The policy is sound, the standard is right, and the failure comes at the moment the pallet leaves the building. Nobody counted the drives going out, nobody received a serial-numbered certificate coming back, and six months later nobody can say whether a given laptop was destroyed.
So we would push you to write the policy around evidence. Every clause should end with a record someone can pull in an audit. If a requirement does not produce a document, it is a hope, not a control.
We would also say that physical location matters more than people expect. For larger drive volumes, on-site destruction removes the transit risk entirely, and we handle on-site destruction for 50+ hard drives. And since asset value drops quickly as hardware ages, we think the policy should set a deadline for retirement decisions, so recoverable equipment does not decay in storage.
— Keith
How we can support your policy
If your policy calls for certificates, witnessed destruction or itemized records, those are things we provide. Our facility is EPA-certified for processing and registered with California’s Department of Toxic Substances Control, and we offer flexible scheduling with receipts and certificates for your compliance files. Depending on your volume and sensitivity, start with onsite data destruction, hard drive destruction or IT asset recovery, where we pay up front for equipment with remaining value. You can request a free quote through our main page.
FAQ
Is there one federal e-waste law my policy must follow?
No. The EPA overview describes a patchwork: federal hazardous waste rules apply only to e-waste that meets certain criteria, and 25 states have their own e-waste recycling laws. Your policy should name the agency in each state where you operate and keep that list current.
What is the difference between a media destruction policy and an e-waste policy?
A media destruction policy covers only how data-bearing devices are sanitized or destroyed and how that is proven. An e-waste policy is broader: it also covers inventory, environmental handling, batteries, vendor selection and reporting. In most companies, media destruction is one section inside the e-waste or ITAD policy, as in the template above.
Which standard should the policy cite for data destruction?
Most US organizations cite NIST SP 800-88, which in its current Revision 2 (September 2025) focuses on running a full sanitization program. Your own regulators or contracts may require more, so check them before you finalize the wording.
How often should we review the policy?
At least once a year, and whenever you change vendors, add hardware types such as solar panels or new storage technology, or expand into a new state. A review also follows any disposal incident.
Sources
- SP 800-88 Rev. 2, Guidelines for Media Sanitization (NIST CSRC)
- Guidelines for Media Sanitization, Rev. 2 (NIST CSRC news)
- Broad Overview of E-Waste Management Policies in the U.S. (EPA)
- eCycling FAQ, Pacific Southwest (EPA archive)
- Battery Collection Tip Sheet (EPA)
- Kentucky hazardous waste sentencing (EPA news release)
- National Policy for Management of WEEE (South Africa)