Chain of Custody

When decommissioned notebooks, servers or hard drives leave your premises, a simple question arises: can you prove for every single device where it was until the data was verifiably erased or destroyed? That is exactly what a chain of custody does. This glossary entry explains the term, shows the individual links in the chain and names the points where it most often breaks in practice.

What does chain of custody mean?

The term comes from forensics: a piece of evidence is admissible in court only if it can be shown without gaps who has had it in hand since it was secured. Later the term was adopted in other fields, for example in the certification of supply chains for wood and paper products.

In der IT Asset Disposition (ITAD), also der geordneten Ausmusterung von IT-Hardware, bedeutet Chain of Custody: Jedes Gerät und jeder Datenträger ist von der Bestandsaufnahme beim Kunden bis zum Abschluss eindeutig identifizierbar. Jede Übergabe ist mit Zeitpunkt, beteiligten Personen und Zustand dokumentiert. Am Ende steht für jede Seriennummer ein Nachweis, was mit ihr geschehen ist.

Why chain of custody matters in IT decommissioning

A decommissioned notebook is not scrap metal but a data carrier containing customer, personnel or business data. As long as this data has not been erased, the same protection obligations apply to the device as in ongoing operation. The GDPR requires that you can demonstrate compliance with the data protection principles (Accountability, Art. 5(2) GDPR) and that personal data is protected by suitable technical and organizational measures (Art. 32 GDPR).

If a device disappears between the office and the service provider, this can be a reportable data breach. Under Art. 33 GDPR, it generally has to be reported to the supervisory authority without undue delay and, where possible, within 72 hours. Without a chain of custody, in an emergency you would not even know at which point the device was lost.

If you commission a service provider with erasure or destruction, it is generally a processor. The documented chain of custody is then the proof that it actually implements the agreed measures.

The links in the chain

A chain of custody consists of several links. Each link needs its own proof, and all proofs must match via a unique identifier, usually the serial number.

Link	What is documented	Typical proof
Inventory	Which devices are being decommissioned: type, manufacturer, model, serial number, asset tag if applicable	Inventory list or device list
Packaging	Which devices are in which container, seal number	Content overview, seal number
Handover	Who handed over to whom and when, number of containers	Signed handover record
Transport	Vehicle, route, time period, intermediate stops	Trip and tracking data, transport documents
Goods receipt	Condition of the seals, comparison of serial numbers with the list, discrepancies	Goods receipt record, discrepancy report
Deletion or destruction	Method, result and time for each data carrier	Erasure certificate or certificate of destruction for each serial number
Recovery	Resale, spare-parts recovery or recycling	Proof of recovery or disposal

What matters is the cross-check: the serial numbers from the inventory must be found again at goods receipt and in the erasure or destruction proof. Anything missing in a link must be noticed immediately and clarified.

How to recognize a reliable chain of custody

• Unique identifier for each device: Proofs name serial numbers, not just quantities or weight.
• No undocumented intermediate stops: Every change of location is recorded. Direct transports without intermediate storage shorten the chain.
• Tamper-proof closures: Containers are closed with numbered security seals whose numbers appear in the record.
• Target-actual comparison on receipt: The service provider compares the delivered devices with your list and reports discrepancies.
• Protected processing: Access control and video surveillance where data carriers await erasure or destruction.
• Proofs you can retrieve: Records and certificates are available to you and can still be matched to a device years later.
• Clear rules for subcontractors: If part of the chain is outsourced to third parties, the same requirements apply there.

Typical gaps in practice

• Old devices stand for weeks in open boxes in the hallway or basement.
• A courier collects boxes without anyone signing a device list.
• Removed hard drives are collected separately from the device, but without their own serial number list.
• The destruction proof only states a weight, not serial numbers.

Example: 120 notebooks from one site

A simplified example shows how the chain helps in everyday work. A company decommissions 120 notebooks at one site. IT creates an inventory list with serial numbers and passes it to the service provider in advance.

1. At collection, the devices are packed into containers and sealed. The handover record lists 120 devices and the seal numbers.
2. At goods receipt, the seals are intact. The cross-check, however, yields only 119 serial numbers.
3. The discrepancy is reported immediately. The internal check shows that one device was still in an employee’s home office and had ended up on the list by mistake.
4. In the end, erasure certificates for each serial number are available for the 119 devices. The missing device is delivered later and documented separately.

Without a chain of custody, the gap might only have been noticed months later during an audit, and nobody could have said where the device had gone.

Chain of custody at Second IT

Second IT collects hardware using its own Security logistics : direct trips without intermediate storage, GPS monitoring, tamper-proof sealing and insured transport. According to the T&Cs, all data carriers are sealed during secure logistics, and the seals are only removed in-house in Schwäbisch Hall.

At goods receipt, all delivered devices are checked for storage media, including forgotten USB sticks or hidden data carriers, and registered by serial number. Processing takes place in areas with access control and video surveillance. Every device is erased with Blancco and receives a digitally signed Certificate of destruction per device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5) and documented with a certificate of destruction. Audit reports and live tracking are available in the customer portal.

If you send devices yourself, seal, for example, a PELI Case with two high-security seals in accordance with ISO 17712 and have the handover acknowledged on your copy of the handover record.

Distinction from related terms

One Erasure certificate only proves the last link in the chain, namely the erasure of a data carrier. The chain of custody covers all the links before it. An audit trail, in turn, is the technical logging of actions in a system. It can be part of the chain of custody but does not replace the proof of physical handovers. What a certificate of destruction and an erasure report should contain is explained in our guide Certificate of destruction and erasure report. What to look out for when choosing a service provider can be read in Choosing an ITAD provider.

Frequently asked questions about chain of custody

What does chain of custody mean in German?

"Verwahrkette" or "Beweismittelkette" are common. This refers to the unbroken documentation of who had an object in custody, when, where and in what condition. In IT decommissioning, the term refers to devices and data carriers up to erasure, destruction or recovery.

Is a chain of custody required by law?

No law uses the term explicitly. However, the GDPR obliges you to protect personal data appropriately and to demonstrate compliance (Art. 5(2) and Art. 32 GDPR). A documented chain of custody is the practical way to provide this proof for decommissioned data carriers.

Which documents belong to a chain of custody?

Typical are an inventory list with serial numbers, the content overview of the containers with seal numbers, a signed handover record, transport data, the goods receipt record with target-actual comparison, and erasure or destruction certificates for each serial number. For recovery, disposal or recycling proofs are added.

What should I do if a device is missing at goods receipt?

The discrepancy should be reported immediately and documented with the serial number. Check internally whether the device was handed over at all. If its whereabouts cannot be clarified and personal data was on it, assess with your data protection officer whether a notification under Art. 33 GDPR is necessary.

Is an erasure certificate the same as a chain of custody?

No. An erasure certificate proves only the last link in the chain, namely the erasure of a data carrier. The chain of custody covers all the links before it, from inventory through handover and transport to goods receipt. An audit trail does not replace the proof of physical handovers.