Electronic devices
- Desktops, laptops and servers
- LCD, OLED and older CRT monitors and TVs
- Printers, phones, tablets and AV gear
E-WASTE & DATA GUIDE
What California requires when a business gets rid of computers, monitors, batteries and other electronics, how to handle the data on them, and what your certificate of destruction should prove.
No. The California Department of Toxic Substances Control (DTSC) treats e-waste as universal waste, which is a category of hazardous waste. A business cannot put universal waste in the trash, the dumpster or the landfill. That includes the monitors in the storage closet, the laptops nobody claimed and the printer that has been “going to IT” since last year.
California is also stricter than federal guidance in one place offices trip over. U.S. EPA notes that most communities let households trash alkaline batteries. DTSC classifies most alkaline batteries as universal waste. The drawer of dead AAs counts.
On an office exit, electronics usually surface late, when the furniture is gone and the leftovers are suddenly visible. The rules are not complicated. The problem is that they get handled in the last 48 hours, by whoever is still in the building.
DTSC lists eight universal waste categories. These are the ones that show up in a typical commercial office.
Under California’s universal waste regulations (Cal. Code Regs., tit. 22, § 66273), the business that generated the waste is responsible for getting it to the right place. The points that matter on a move-out:
This is a plain-English summary for planning, not legal advice. DTSC’s Universal Waste Fact Sheet and e-waste page are the source. Generators are responsible for determining whether a waste is hazardous, so confirm anything unusual with DTSC or your environmental advisor.
Before a device is a waste problem, it is a data problem. California Civil Code § 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information by shredding, erasing or otherwise making that information unreadable. A laptop that leaves the building unwiped, without a provider you have arranged to sanitize it and document the result, is a record that was not properly disposed of.
Computers, servers, phones, tablets and external drives are obvious. Copiers and multifunction printers are the ones that get missed. The FTC’s copier data security guide explains that a digital copier’s hard drive stores data about the documents it copies, prints, scans, faxes or emails.
Leased copiers go back to the lessor, data and all, unless you plan for it. The FTC’s advice: check whether your contract lets you keep the drive or requires the provider to overwrite it, and ask the dealer or servicer to remove or overwrite it (usually for a fee). Do not pull the drive yourself. It may carry firmware the machine needs, and the lessor will not thank you for returning a copier that no longer boots.
NIST Special Publication 800-88, the standard most data destruction programs point to, was revised in September 2025 (Rev. 2). It still sorts sanitization into three levels:
Deleting files or reformatting is none of these. Which level you need depends on what was on the device and where it is going next: redeployed inside your company, resold, or recycled. That is a decision for your IT or security lead, and it should be made before the devices are boxed, not after.
A certificate that says “one pallet of mixed electronics, recycled” proves a pallet left your dock. It does not prove what happened to the finance team’s laptops. Ask for a record at the device level.
NIST SP 800-88 Rev. 2 says a sanitization certificate should record at least:
The i-SIGMA NAID AAA certification specifications also have certified providers log serial numbers and return that log to the client unless the client opts out. Either way, the test is simple: you should be able to take your asset list, pick any serial number, and find it on a certificate.
Ask which certifications the vendor holds, then check the facility yourself in the issuing body’s directory. A logo on a website is not a verification.
Then ask the questions the directories cannot answer: who picks up, whether devices are counted and serial-logged at your site or at theirs, how long until you receive certificates, and what happens to a drive that fails a wipe.
A one-page planning aid for getting electronics and universal waste out of an office correctly. Check items off on screen, or print it for the move-out binder.
General planning guidance, not legal advice. DTSC regulations, your lease, your leasing contracts and your own data security policy control.
On an office exit we inventory the electronics alongside the furniture, keep universal waste out of the general haul, and coordinate pickup with certified third-party ITAD and e-waste vendors inside the building’s dock and elevator windows. Then we match the certificates back to the inventory so the closeout file is complete. See ITAD & cabling and our office decommissioning process.
We do not set your data security policy, and we do not give legal advice. The sanitization level for each device is your IT or security lead’s call, and questions about what the regulations require of your business belong with DTSC or your advisor.
No. DTSC classifies e-waste as universal waste, a type of hazardous waste, and no business may dispose of universal waste in the trash. It has to go to a universal waste handler or a destination facility that recycles it.
No. Unlike federal guidance for households, California treats most alkaline batteries as universal waste. Collect them with your other batteries and send them to a recycler.
At minimum, per NIST SP 800-88 Rev. 2: each device’s manufacturer, model and serial number, the sanitization method and technique, the tool used, how it was verified, and the name, date, location and signature of the person responsible. You should be able to match every serial number on your asset list to a certificate.
California Civil Code § 1798.81 requires reasonable steps to make customer personal information unreadable when records are disposed of. Either sanitize before devices leave your custody or use a certified provider who documents sanitization at the serial level. Deleting files or reformatting does not remove the data.
Check the lease for drive ownership or overwrite terms, then ask the dealer or servicer to remove or overwrite the drive before return, usually for a fee. The FTC advises against pulling the drive yourself because it may hold firmware the machine needs.
Closet full of old electronics and a handover date coming? Bring the list to the walkthrough.
Related: Server Room Exit Protocol · Office Exit Checklist