E-WASTE & DATA GUIDE

Electronic Waste Disposal for Businesses in California: Rules, Data and Certificates

What California requires when a business gets rid of computers, monitors, batteries and other electronics, how to handle the data on them, and what your certificate of destruction should prove.

REQUEST A WALKTHROUGH
A pile of discarded computer circuit boards and graphics cards waiting for recycling
Photo: Nathan Cima / Unsplash

Can a business throw old electronics in the trash in California?

No. The California Department of Toxic Substances Control (DTSC) treats e-waste as universal waste, which is a category of hazardous waste. A business cannot put universal waste in the trash, the dumpster or the landfill. That includes the monitors in the storage closet, the laptops nobody claimed and the printer that has been “going to IT” since last year.

California is also stricter than federal guidance in one place offices trip over. U.S. EPA notes that most communities let households trash alkaline batteries. DTSC classifies most alkaline batteries as universal waste. The drawer of dead AAs counts.

On an office exit, electronics usually surface late, when the furniture is gone and the leftovers are suddenly visible. The rules are not complicated. The problem is that they get handled in the last 48 hours, by whoever is still in the building.

Need a working list? Jump to the printable e-waste move-out checklist.

What counts as e-waste and universal waste on an office exit

DTSC lists eight universal waste categories. These are the ones that show up in a typical commercial office.

Electronic devices

  • Desktops, laptops and servers
  • LCD, OLED and older CRT monitors and TVs
  • Printers, phones, tablets and AV gear

Batteries

  • Most alkaline batteries, not just rechargeables
  • Lithium packs from laptops, phones and tools
  • The drawer of spares nobody remembers buying

Lamps & other items

  • Fluorescent tubes and CFLs, including spares in storage
  • Mercury thermostats
  • Aerosol cans that are not empty, when the contents or propellant are hazardous

The rules that apply to the business that generated it

Under California’s universal waste regulations (Cal. Code Regs., tit. 22, § 66273), the business that generated the waste is responsible for getting it to the right place. The points that matter on a move-out:

  • No trash, no landfill. This applies even to very small quantity generators, who are exempt from most handler requirements.
  • One year, maximum. Handlers can accumulate universal waste for no longer than one year and must be able to show how long it has been sitting there (a dated container, a label or an inventory).
  • Label it. The regulations specify wording such as “Universal Waste—Electronic Device(s)”, “Universal Waste—Battery(ies)” and “Universal Waste—Lamp(s)”.
  • Ship it to the right kind of destination. Universal waste can only go to a universal waste handler or transporter, or to a destination facility that recycles or treats that category. A general junk hauler dropping it at a transfer station does not qualify.
  • Notification thresholds are high. Advance notification to the regulator is triggered by accumulating 5,000 kilograms, and DTSC requires an annual report from e-waste generators above 11,000 pounds a year. An office below those lines has no notice duty. The trash ban and destination rules still apply; the time limit and labeling rules apply too, unless you qualify as a very small quantity generator.

This is a plain-English summary for planning, not legal advice. DTSC’s Universal Waste Fact Sheet and e-waste page are the source. Generators are responsible for determining whether a waste is hazardous, so confirm anything unusual with DTSC or your environmental advisor.

Data first, waste second

Before a device is a waste problem, it is a data problem. California Civil Code § 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information by shredding, erasing or otherwise making that information unreadable. A laptop that leaves the building unwiped, without a provider you have arranged to sanitize it and document the result, is a record that was not properly disposed of.

Know which devices hold data

Computers, servers, phones, tablets and external drives are obvious. Copiers and multifunction printers are the ones that get missed. The FTC’s copier data security guide explains that a digital copier’s hard drive stores data about the documents it copies, prints, scans, faxes or emails.

Leased copiers go back to the lessor, data and all, unless you plan for it. The FTC’s advice: check whether your contract lets you keep the drive or requires the provider to overwrite it, and ask the dealer or servicer to remove or overwrite it (usually for a fee). Do not pull the drive yourself. It may carry firmware the machine needs, and the lessor will not thank you for returning a copier that no longer boots.

Clear, Purge or Destroy

NIST Special Publication 800-88, the standard most data destruction programs point to, was revised in September 2025 (Rev. 2). It still sorts sanitization into three levels:

  • Clear: logical techniques, such as overwriting, applied to all user-addressable storage. NIST’s Rev. 2 FAQ says multi-pass overwriting is unnecessary; Clear is typically a single pass.
  • Purge: makes recovery infeasible even with state-of-the-art lab techniques, while the media may stay reusable.
  • Destroy: makes recovery infeasible and leaves the media unable to store data at all.

Deleting files or reformatting is none of these. Which level you need depends on what was on the device and where it is going next: redeployed inside your company, resold, or recycled. That is a decision for your IT or security lead, and it should be made before the devices are boxed, not after.

What a certificate of destruction should actually show

A certificate that says “one pallet of mixed electronics, recycled” proves a pallet left your dock. It does not prove what happened to the finance team’s laptops. Ask for a record at the device level.

NIST SP 800-88 Rev. 2 says a sanitization certificate should record at least:

The device

  • Manufacturer and model
  • Serial number
  • Your asset or property tag, if you use one
  • Media type and where it came from

What was done

  • Method: Clear, Purge or Destroy
  • Technique, such as overwrite, block erase, cryptographic erase or shredding
  • Tool used, with version
  • How it was verified

Who did it

  • Name and title of the person who performed or verified it
  • Date and location
  • Contact information and signature

The i-SIGMA NAID AAA certification specifications also have certified providers log serial numbers and return that log to the client unless the client opts out. Either way, the test is simple: you should be able to take your asset list, pick any serial number, and find it on a certificate.

How to check the recycler before the truck shows up

Ask which certifications the vendor holds, then check the facility yourself in the issuing body’s directory. A logo on a website is not a verification.

Then ask the questions the directories cannot answer: who picks up, whether devices are counted and serial-logged at your site or at theirs, how long until you receive certificates, and what happens to a drive that fails a wipe.

What changed in 2025 and 2026

  • NIST SP 800-88 Rev. 2 (September 2025) replaced the 2014 Rev. 1. It moves away from media-by-media technique tables toward an enterprise sanitization program and points to IEEE 2883 for techniques. If a vendor’s paperwork still cites Rev. 1, ask whether their process has been updated.
  • Battery-embedded products joined California’s e-waste program on January 1, 2026 under SB 1215. Products whose batteries are not easily removable now carry a fee at purchase of 1.5% of the price, capped at $15 in 2026, and approved recyclers can claim payments for them. CalRecycle has set the cap at $1 starting January 1, 2027. CalRecycle has the details.

E-waste move-out checklist

A one-page planning aid for getting electronics and universal waste out of an office correctly. Check items off on screen, or print it for the move-out binder.

General planning guidance, not legal advice. DTSC regulations, your lease, your leasing contracts and your own data security policy control.

01 Inventory
02 Decide each device’s path
03 Vendor
04 On the day
05 Closeout

Want the inventory and vendor coordination handled as part of the exit? Tell Joel what is in the closet.

Exiting a server room too? The Server Room Exit Protocol covers cutover, rack teardown and cabling, and the Office Exit Checklist covers the rest of the move-out.

Where we fit, and where we do not

On an office exit we inventory the electronics alongside the furniture, keep universal waste out of the general haul, and coordinate pickup with certified third-party ITAD and e-waste vendors inside the building’s dock and elevator windows. Then we match the certificates back to the inventory so the closeout file is complete. See ITAD & cabling and our office decommissioning process.

We do not set your data security policy, and we do not give legal advice. The sanitization level for each device is your IT or security lead’s call, and questions about what the regulations require of your business belong with DTSC or your advisor.

Common questions

Can we put old computers or monitors in the dumpster in California?

No. DTSC classifies e-waste as universal waste, a type of hazardous waste, and no business may dispose of universal waste in the trash. It has to go to a universal waste handler or a destination facility that recycles it.

Can a business throw away alkaline batteries in California?

No. Unlike federal guidance for households, California treats most alkaline batteries as universal waste. Collect them with your other batteries and send them to a recycler.

What should a certificate of destruction include?

At minimum, per NIST SP 800-88 Rev. 2: each device’s manufacturer, model and serial number, the sanitization method and technique, the tool used, how it was verified, and the name, date, location and signature of the person responsible. You should be able to match every serial number on your asset list to a certificate.

Do we need to wipe drives before sending them to a recycler?

California Civil Code § 1798.81 requires reasonable steps to make customer personal information unreadable when records are disposed of. Either sanitize before devices leave your custody or use a certified provider who documents sanitization at the serial level. Deleting files or reformatting does not remove the data.

What do we do about the hard drive in a leased copier?

Check the lease for drive ownership or overwrite terms, then ask the dealer or servicer to remove or overwrite the drive before return, usually for a fee. The FTC advises against pulling the drive yourself because it may hold firmware the machine needs.

Closet full of old electronics and a handover date coming? Bring the list to the walkthrough.

REQUEST A WALKTHROUGH

Related: Server Room Exit Protocol · Office Exit Checklist