Every non-profit eventually faces the question of what to do with aging, obsolete computers that no longer power on or support modern software. Simply tossing an old desktop into a recycling dumpster or dropping it off at a local charity shop without proper preparation creates massive compliance risks. Old hard drives often contain donor credit card details, staff payroll files, and confidential client records that can be recovered with basic software tools.

De-Register and Securely Sanitize Every Drive

Before a machine leaves your facility, remove it from your organization’s management portal, unlink all cloud accounts, and sanitize the internal drive. Standard operating system formats or moving files to the “Trash” do not permanently destroy data. Use industry-standard multi-pass data wiping software (compliant with NIST SP 800-88 standards) to overwrite every sector of the disk. For dead drives that cannot be booted or wiped via software, physical destruction—such as magnetic degaussing or mechanical puncturing—is strictly required.

Partner with Certified R2 or e-Stewards Recyclers

Discarding electronic waste in standard municipal trash bins is illegal in many jurisdictions due to toxic heavy metals such as lead, mercury, and cadmium. Establish a formal relationship with an electronics recycler certified under R2 (Responsible Recycling) or e-Stewards standards. Reputable recyclers guarantee that old electronics are processed in an environmentally sound manner and do not end up dumped illegally overseas. Many certified recyclers provide free pickup services for registered 501(c)(3) entities.

Require and Archive Certificates of Destruction

Never consider a decommissioning process complete until you hold documented proof of disposal. Require your recycling partner to issue a serialized “Certificate of Destruction” itemizing every drive and asset tag received. File this certificate in your administrative compliance records alongside the updated inventory sheet marked as “Decommissioned.” When grant auditors or regulatory bodies conduct security reviews, having these certificates readily available proves that your organization maintained rigorous data stewardship through the entire hardware lifecycle.