The ITAD Process Step by Step: From Pickup to Payment

The ITAD process is a documented sequence that moves retired IT equipment from pickup to payment. It runs in 9 steps: inventory, transport, receiving, grading, data sanitization, resale, recycling, reporting and payment. A serial number tracks every device. A chain of custody records every handoff.

Businesses use secure ITAD services to retire laptops, desktops, servers, and phones without exposing stored data. This guide explains each step, the document it produces and how the final payout is calculated. The broader definition of IT asset disposition sits in What Is ITAD? IT Asset Disposition Explained for Businesses.

What Are the 9 Steps of the ITAD Process?

The ITAD process has 9 steps across 4 phases: preparation and pickup, facility processing, reuse or recycling, and settlement.

• Build the asset inventory.

• Transport the equipment.

• Reconcile the received devices.

• Audit and grade each device.

• Sanitize every data-bearing drive.

• Remarket the reusable devices.

• Recycle the non-reusable materials.

• Issue the settlement report.

• Pay the net value.

This end-to-end ITAD process is the documented workflow behind WeBuyBackElectronics’ IT Asset Disposition (ITAD) Services. Step counts vary between providers. The underlying ITAD workflow covers the same work. Two controls run across all 9 steps: chain of custody and serialized tracking.

How Do Chain of Custody and Serialized Tracking Work?

Chain of custody records every handoff of a device and serialized tracking ties each record to one serial number. Together, they prove where each device went and what happened to it. Each custody record captures 4 details: date, handler, location and seal or container ID. Gartner’s Market Guide for IT Asset Disposition ranks logistics and chain of custody among the 3 highest-risk ITAD tasks. The other 2 are data sanitization and recycling.

Serialized tracking uses 2 identifiers as the record key: the manufacturer serial number and the asset tag. The same serial appears on 4 documents: the pickup manifest, receiving report, erasure certificate, and settlement report. These linked records form the audit trail that auditors, regulators, and insurers request. Weight-based certificates list only total pounds recycled. Serial-level records prove the outcome for each laptop, server, or phone.

Phase 1: Preparation and Pickup

Phase 1 produces a verified asset list and moves the equipment into a sealed, documented shipment.

Step 1: Asset Inventory and Preparation

Asset inventory is a client-side list of every device leaving the building, recorded before pickup. It captures 5 attributes per device: type, make and model, serial number, asset tag, and location. This list is the baseline for reconciliation in Step 3. The same list starts a quote for IT Equipment Buyback Services.

This ITAD checklist prepares laptops, tablets, and phones for pickup:

• Export the device list from the asset register or MDM console, such as Microsoft Intune or Jamf.

• Remove MDM enrollment from each device.

• Disable Activation Lock on MacBooks, iPads, and iPhones.

• Clear BIOS and firmware passwords.

• Pack power adapters with each laptop.

• Leave internal drives installed.

Locked devices fail functional testing and lose resale value. Common mistake: pulling hard drives before pickup. A laptop without its drive sells for less. Verified erasure in Step 5 protects the data without removal.

Step 2: Logistics and Freight

Logistics and freight move equipment from the client site to the ITAD facility under sealed, documented control. Pickups follow 1 of 2 models: offsite processing or onsite service. Onsite service suits ITAD services for data centers, where racks, servers, and storage arrays are decommissioned in place. WeBuyBackElectronics runs these projects through its Data Center Buyback & Decommissioning Services.

Secure ITAD services apply 4 freight controls:

• Palletize devices by type.

• Seal each container with a numbered, tamper-evident seal.

• Transport loads in locked, GPS-tracked vehicles.

• Sign the bill of lading at handoff.

The signed bill of lading is the first custody record. Common mistake: releasing equipment without a signed manifest. An unsigned handoff leaves no proof of what left the site.

Phase 2: Processing at the ITAD Facility

Phase 2 confirms what arrived, grades each device, and removes all stored data before resale.

Step 3: Receiving and Reconciliation

Receiving and reconciliation match every arriving device against the pickup manifest and the client inventory. Technicians verify the seal numbers first. They then scan each serial number and asset tag. The output is a receiving report. Any mismatch triggers a discrepancy report. It flags 3 mismatch types: missing devices, extra devices, and wrong serial numbers. Each mismatch is traced through the bill of lading, the seal log, and the client list.

Common mistake: filing the receiving report without checking it. The client inventory from Step 1 is the only independent check.

Step 4: Audit and Grading

Audit and grading record each device’s specifications and condition, then assign a grade that sets its value. The audit captures 4 specifications: processor, memory, storage capacity, and battery health. Functional tests cover the screen, keyboard, ports, and cameras.

No universal grading standard exists. These 4 grade definitions are common:

Common mistake: comparing vendor quotes without comparing grading definitions. One vendor’s Grade B can equal another vendor’s Grade C.

Step 5: Data Sanitization

Data sanitization makes stored data unrecoverable and records proof for every drive. NIST SP 800-88 Rev. 2 defines 3 methods: Clear, Purge, and Destroy. NIST published Rev. 2 in September 2025. It supersedes Rev. 1 from December 2014.

• Clear overwrites user-addressable storage against simple recovery.

• Purge defeats state-of-the-art laboratory recovery and keeps the drive reusable.

• Destroy leaves the media unusable, for example through shredding or disintegration.

Rev. 2 prefers Purge over Clear whenever possible. It refers to technique selection to IEEE 2883, the industry standard for sanitizing storage.

Degaussing has no effect on SSDs. Flash memory stores data without a magnetic charge. Rev. 2 also excludes degaussing from its approved Destroy techniques.

Data wiping preserves the device for resale. Hard drive shredding ends its reuse value. Onsite shredding destroys drives at the client site; offsite erasure runs after sealed transport. Rev. 2 recommends a certificate of data destruction for each device. It records the method, technique, tool and version, verification result, and signature.

Common mistake: treating a factory reset as full sanitization. A reset meets Clear at most and produces no per-device certificate.

Phase 3: Reuse or Recycling

Phase 3 routes each device by grade: reusable devices go to remarketing, and the rest go to certified recyclers. The value first rule sets the order. Reuse comes first; recycling comes last.

Step 6: Remarketing

Remarketing is the resale of sanitized, graded devices to recover their residual value. It applies to Grade A, B, and C devices. Resale channels include wholesale buyers, B2B resellers, and refurbished marketplaces.Residual value depends on 4 attributes: age, grade, specification and market demand. Refurbishment adds value through cleaning, part replacement and operating system reinstallation. The Bulk Buyback Program handles bulk electronics buyback for businesses, schools, and government agencies. IT asset value recovery ends here for every resold device. Server resale follows the same grading and pricing rules, detailed in How to sell used servers in the U.S. (2026 Playbook).

Step 7: Downstream Recycling

Downstream recycling is the certified processing of equipment that cannot be resold into recovered materials. It covers Grade D devices, shredded drives, and damaged parts, such as cracked screens and swollen batteries. Recyclers separate 3 material streams: metals, plastics, and glass.

The Global E-waste Monitor 2024 counted 62 million tonnes of e-waste in 2022. Only 22.3% was documented as formally collected and recycled. Small IT equipment, such as laptops, phones, and routers, totaled 4.6 million tonnes. Its documented recycling rate was 22%.

Export is the main downstream risk. In 2022, 5.1 million tonnes of e-waste crossed borders. About 65% of it moved from high-income to lower-income countries through undocumented channels. R2v3 and e-Stewards require documented due diligence on every downstream vendor. e-Stewards also bans hazardous e-waste exports to developing countries. The final record is a certificate of recycling.

Common mistake: skipping the downstream vendor list. Certified ITAD providers disclose where each material stream goes.

Phase 4: Settlement and Payment

Phase 4 converts every device outcome into a line-item report and a net payment.

Step 8: Settlement Report

A settlement report is a serial-level record of each device’s grade, disposition, sale value, fees, and net value. It is the final ITAD report for the lot. Illustrative values:

Verification takes 3 cross checks. Match each serial against the client inventory, the receiving report, and the erasure certificate. A serial missing from the settlement report is an open custody gap. The receiving report is the evidence for resolving it.

Step 9: Payment Terms

Payment terms set how device value is priced, which fees are deducted and when the business is paid. IT asset disposal services price lots in 1 of 3 models:

Net payout equals gross sale value minus freight, processing and sanitization fees. Final payouts differ from quotes for 3 reasons: lower grades, locked devices and count discrepancies. 

Common mistake: comparing gross quotes instead of net payouts. A higher quote with higher fees can pay less.

How Long Does the ITAD Process Take From Pickup to Payment?

The ITAD process takes 3-4 days from pickup to payment for a standard business lot. Each phase produces its own paperwork:

4 factors change the timeline: lot size, device locks, inventory accuracy, and the pricing model. Locked devices stall grading. Revenue share extends payment until each device sells. Retired devices also lose resale value while they sit in storage.

Who Is Responsible for Data and Compliance During ITAD?

The business that owns the data keeps primary accountability for it through all 9 steps, including after pickup. ITAD vendors carry separate legal duties of their own. Under HIPAA, business associates have been directly liable for Security Rule compliance since the HITECH Act. Under GDPR Article 28, each processor works under a binding contract with the controller.

The stakes are measurable. IBM’s Cost of a Data Breach Report 2026 puts the global average breach cost at $4.99 million, a 12% rise. In 2022, the SEC fined Morgan Stanley Smith Barney $35 million over decommissioned hard drives and servers (TechRepublic). The firm hired a moving company with no data destruction experience. Its devices resold at online auction with customer data still on them.

In the USA, 3 rules shape an ITAD program. HIPAA requires disposal and media re-use procedures under 45 CFR 164.310(d)(2). CCPA covers California consumer data on retired devices. State e-waste laws, such as California’s, restrict landfill disposal of electronics.

An ITAD vendor holds 5 certifications worth verifying: