Match the pickup to the approved provider, destination, and asset list, then confirm the authorized data-handling route. A collection receipt proves a transfer was recorded; it does not by itself prove the devices were sanitized.
A retired laptop may still hold company or customer data. Before it leaves for recycling, confirm that the pickup covers that asset and that its data will follow the approved sanitization process.
Extra devices, substitute collectors, early pickups, and changed destinations need confirmation from the owner who approved the release. A collection receipt alone cannot settle what happened to the data.
What went wrong in the Morgan Stanley disposal case
In September 2022, the SEC announced that Morgan Stanley Smith Barney agreed to pay $35 million to settle charges involving failures to protect customer information. The SEC found that the firm used a moving and storage company without data-destruction expertise and failed to monitor its work properly. Some devices containing customer information were resold without that information being removed. The firm settled without admitting or denying the findings. SEC: Morgan Stanley Smith Barney disposal findings
This was a documented disposal and oversight failure. The SEC release does not describe a fake recycling driver or establish a social-engineering campaign. The lesson for a pickup review is that handing over equipment does not tell you whether its data was sanitized.
That distinction remains useful when the collection itself is legitimate. An approved supplier, a signed receipt, and a closed facilities ticket can coexist with an unresolved question about a particular drive. Keep that unresolved drive visible in the disposal record.
A pickup receipt is not a sanitization record
A collection record answers who received which items and where they were going. A sanitization record answers what was done to the data and whether the result was accepted. One record can link to the other, but one should not silently substitute for the other.
NIST SP 800-88 Revision 2, published in September 2025, defines sanitization in terms of making access to target data infeasible for a given level of effort. It separates checking the operation’s result from deciding whether that result is adequate, and calls for documentation tied to the media. These distinctions explain why a general “collected for recycling” receipt is incomplete evidence of sanitization. NIST SP 800-88 Rev. 2, sections 4.5–4.6
The release route depends on your approved program. Some equipment is sanitized before transfer. Some moves to an approved provider for treatment under defined custody and confidentiality arrangements. Do not interpret the second route as permission to send unreviewed devices to anyone promising to destroy them. The owner needs to approve that route and its controls before the handoff.
NPSA’s secure-destruction guidance addresses storage, transportation, provider selection, and records as parts of the process. Its classification-specific standards are written for sensitive government material; use the process considerations according to your own requirements rather than treating every standard as a universal company obligation. NPSA: secure destruction
Track the assets and the outcome
- Match the pickup
Confirm provider, destination, exact assets or controlled batch. The owner resolves changes.
- Confirm the data route
Choose accepted sanitization before release, or approved controlled transfer to a treatment provider. The owner approves the route.
- Record the handoff
Record items, recipient, time, and destination. Keep unresolved items out.
- Review before closeout
Reconcile assets and required sanitization evidence. Close accepted results under policy; keep missing evidence open with an owner.
A collection receipt records custody. It does not prove sanitization.
Give each exception a named owner
Before the appointment, make one release record available to the staff handling the pickup. It should identify the approved supplier and destination, the assets or sealed batches covered, the internal approver, and the approved data-handling route. Link to the restricted supporting records rather than placing sensitive device or employee details on a public loading-bay notice.
At collection, compare what is being handed over with that record. If the organization tracks individual serial numbers, a matching total count is not enough when the identifiers differ. Ten expected laptops and ten different laptops are different transfers. If sealed batches are used, follow the approved batch and seal reconciliation procedure instead of improvising a new one at the door.
A changed driver may be ordinary. A changed destination may be an authorized scheduling adjustment. Both should reach the owner who can confirm them through the supplier contact already held in the procurement or service record. A number printed on the new collection note should not be the only source of reassurance. Our callback contact-source guide covers this problem in more detail.
The collection staff do not need to diagnose storage media or run a wipe. They need a practical way to keep an unapproved item out of the handoff while the owner resolves it. Name a backup approver and decide in advance whether an incomplete collection can proceed for the already approved items.
If the asset list and pickup differ, pause the unresolved items and contact the asset owner. Keep any unapproved equipment in controlled storage with its own pending request. Record the actual transfer after reconciliation; the disposal case remains open until the required treatment evidence is accepted.
Review the evidence before closing the disposal job
The reviewing owner should be able to connect the accepted evidence to the released assets. Where a vendor uses batch records, establish how that batch maps back to your inventory. An invoice describes a commercial transaction; a certificate needs enough detail for the authorized reviewer to understand the claimed treatment and resolve exceptions.
A missing record does not itself prove that data was disclosed. It means the organization has not established the required result. Preserve that distinction in the ticket: “treatment evidence missing for the identified laptop” is more useful than either “all destroyed” or “confirmed breach.” The response team can assess the actual exposure if equipment is lost, diverted, or shown to retain sensitive information.
Do not ask a reception employee to settle uncertainty by booting a retired laptop or browsing its files. Use the approved technical and records-management owners. Before any actual destruction, those owners should also resolve preservation and retention requirements under the organization’s process. This article does not choose a sanitization technique or determine whether a particular record may be destroyed.
Keep unresolved devices assigned to an owner
A pickup ticket should remain open for any unresolved asset or missing treatment record. Give the exception a named owner, whether the problem is an unreachable approver, an inventory mismatch, or incomplete evidence from the provider.
Our new-hire laptop guide follows equipment into active use. Retirement needs the same asset-level accountability, plus evidence that the data reached its approved end state.
