Data Centre Decommissioning in India: Sequencing Compliance, Data Security and Asset Recovery

Updated: October 29, 2026 · 16 min read

When MeitY’s implementation roadmap for the Digital Personal Data Protection Act, 2023 began to firm up through 2025, most Indian IT departments focused on their customer databases and cloud configurations. They largely overlooked the physical layer: the decommissioned servers, storage arrays, and networking hardware sitting on pallets in their data centres, each of them potentially carrying residual personal data and each of them subject to a separate, equally demanding compliance framework under the E-Waste (Management) Rules, 2022. With CPCB enforcement actions against unlicensed e-waste handlers intensifying in FY 2026 and BRSR Core auditors now specifically requesting e-waste disposal certificates, that oversight is no longer cost-free.

Why Data Centre Decommissioning in India Got Complicated in 2026

Three regulatory forces converged in the 24 months leading to October 2026 to make data centre decommissioning India-wide a materially more complex exercise than it was before. First, the DPDPA 2023 moved from gazette notification to active enforcement posture, establishing data fiduciary obligations that clearly extend to the physical destruction of hardware. Second, the E-Waste Rules 2022 — notified by the Ministry of Environment, Forest and Climate Change (MoEFCC) and administered by the Central Pollution Control Board (CPCB) — replaced the 2016 rules with a stricter Extended Producer Responsibility (EPR) architecture, channel controls, and enhanced record-keeping obligations. Third, SEBI’s BRSR Core framework (circular dated 12 July 2023) began pulling e-waste disposal documentation into listed-company sustainability disclosures from FY 2023-24 onwards.

The practical consequence: a data centre operator winding down a Mumbai colocation facility, a Bengaluru cloud node, or an in-house Hyderabad data room can no longer treat decommissioning as a facilities management task. It is simultaneously an IT security project, an environmental compliance exercise, and a corporate governance event. The companies that sequence these three streams correctly recover asset value. The companies that do not face regulatory exposure on two separate fronts.

The Three-Phase Project Sequence Every IT Asset Manager Must Follow

The single most common project failure in Indian data centre decommissioning is physical removal before data sanitisation is complete. Hardware moves to a staging area or a third-party logistics bay, chain-of-custody is broken, and the organisation loses the ability to certify what happened to the media. Under DPDPA Section 8(7), a data fiduciary is required to ensure that personal data is erased when it is no longer necessary for the purpose for which it was collected. Regulators have taken the position that “erasure” for hardware must mean certified media destruction — not reliance on encryption alone.

Phase 1: Inventory and Classification (Weeks 1–3)

Begin with a complete asset register tied to your Configuration Management Database (CMDB). Every device must be tagged with its data classification: does it hold personal data under DPDPA? Does it hold financial records with a statutory retention requirement? Does it hold sensitive government contract data? Classification drives the sanitisation method, which in turn drives whether the asset can be resold, refurbished, or must go directly to a CPCB-authorised recycler. This phase also identifies hazardous sub-components — lithium-ion UPS batteries, lead-acid cells, and mercury-containing components — that trigger separate obligations under the Battery Waste Management Rules, 2022 and the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016.

Phase 2: On-Site Data Sanitisation (Weeks 3–6)

All media sanitisation must occur before any asset leaves the controlled perimeter of the data centre. This is non-negotiable from both a DPDPA and an operational security standpoint. For HDDs, NIST SP 800-88 Rev.1 (Purge standard) or DoD 5220.22-M overwrite standards are acceptable. For SSDs and NVMe drives, cryptographic erasure of the encryption key combined with a verified block-level overwrite is the current industry minimum. Physical shredding or degaussing on-site is the only defensible option for media that cannot be certified erasure-complete through software. Each sanitised or destroyed device must be documented with a serial number, the sanitisation method applied, the technician’s name, and the date — this becomes part of the Certificate of Data Destruction.

Phase 3: Physical Decommission, Transport, and Recycling (Weeks 6–10)

Only after Phases 1 and 2 are complete does physical rack decommissioning begin. This includes structured cable removal, rack depowering, physical asset tagging for transport, and handover to an authorised ITAD vendor or recycler. The transport manifest — tied to CPCB’s e-waste tracking requirements — must accompany every consignment. Do not allow any asset to move under a generic freight bill of lading; the e-waste manifest is a distinct document with its own regulatory standing.

Data Sanitisation Before Physical Movement: The DPDPA Obligation That Cannot Be Delegated

The Digital Personal Data Protection Act, 2023 (DPDPA) establishes the concept of the “data fiduciary” — any person who, alone or in conjunction with others, determines the purpose and means of processing personal data. Data centres and IT organisations that handle employee records, customer databases, or transactional data are unambiguously data fiduciaries. Section 8(7) of the DPDPA requires that a data fiduciary, upon the cessation of the purpose for which data was collected, must delete the personal data and require any data processors to do likewise.

The critical implication for hardware: if a server or storage array holds personal data, the organisation’s DPDPA obligations do not terminate when the device is powered down. They terminate only when the media is demonstrably destroyed or overwritten to a standard that renders recovery impossible. An ITAD vendor that removes hardware from your premises before sanitisation is complete becomes, in regulatory terms, a data processor — and your organisation remains the accountable data fiduciary. Any breach during transit or at the recycler’s facility is your breach, not theirs, for DPDPA enforcement purposes.

MeitY has not yet issued a specific hardware sanitisation standard under DPDPA, but the Data Protection Board’s anticipated guidance is expected to reference IS/ISO/IEC 27040 (Storage Security), which India’s Bureau of Indian Standards has adopted. Until that guidance is published, organisations should document their sanitisation methodology against international standards and retain that documentation for a minimum of 3 years — the limitation period most likely to apply under the Act’s enforcement provisions.

₹250 Crore in Exposure: Mapping the Regulatory Penalties Across Three Statutes

Indian CFOs and DPOs should understand that a poorly executed data centre decommissioning project can trigger simultaneous exposure under three separate regulatory regimes. The table below maps the key penalty provisions as they stand in October 2026.

Statute / Rule	Trigger Event	Maximum Penalty	Enforcing Authority
DPDPA 2023, Section 33(2)	Failure to implement reasonable security safeguards; data breach	₹250 crore per breach incident	Data Protection Board of India (MeitY)
E-Waste (Management) Rules, 2022, Rule 22	Channelling e-waste to unauthorised dismantlers; failure to maintain manifests	Penalties under Environment (Protection) Act, 1986 — up to ₹1 lakh/day of continuing offence + imprisonment	CPCB / State PCBs (e.g., MPCB for Maharashtra)
Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016	Improper disposal of hazardous sub-components (batteries, CRT glass, circuit boards with heavy metals)	Up to ₹1 lakh/day; criminal liability under EPA 1986	CPCB / State PCBs
BRSR Core (SEBI circular 12 July 2023)	Misrepresentation of e-waste disposal in sustainability disclosures	SEBI enforcement action; reputational and listing consequences	SEBI

The ₹250 crore ceiling under DPDPA Section 33 applies per incident, not per breach record. A single hardware disposal event that results in a data breach — say, a storage array resold without media wipe that is subsequently accessed — could constitute one incident but expose personal data belonging to thousands of data subjects. The Data Protection Board has discretion to determine the quantum within the ceiling based on the sensitivity of data involved and the degree of negligence. For large Indian IT-BPM companies and BFSI-sector data centres, this is not a theoretical number.

E-Waste Manifests, CPCB Authorisation, and the Paperwork Chain Auditors Demand

Under Rule 17 of the E-Waste (Management) Rules, 2022, every producer, bulk consumer, and recycler involved in the e-waste chain must maintain records of e-waste handled, including manifests covering the type of e-waste, quantity in metric tonnes, the name and authorisation number of the recycler or dismantler, and the date of handover. These records must be retained for a minimum of 2 years and must be available for inspection by the CPCB or the relevant State Pollution Control Board at any time.

Data centres that decommission more than a de minimis volume of IT hardware in a financial year are classified as “bulk consumers” under the Rules. This triggers a specific obligation: bulk consumers must ensure that their e-waste is deposited only with CPCB-registered producers, dealers, refurbishers, or recyclers — they cannot pass it to an unregistered scrap dealer, even informally. Handing racks to a local kabaadiwala is not just commercially suboptimal; it is a Rule 22 offence.

BRSR Core auditors — particularly for listed companies in the IT, BFSI, and telecom sectors — are now routinely requesting e-waste disposal manifests and recycler authorisation certificates as part of Principle 2 (responsible resource use) disclosures. Organisations that cannot produce a clean manifest trail for the current and immediately preceding financial year are being flagged for disclosure gaps. For data centre operators across Karnataka, Maharashtra, and Telangana — where the bulk of India’s data centre capacity is concentrated — this is an audit risk that has arrived, not one that is approaching.

The CPCB’s e-waste portal is the authoritative source for verifying whether an ITAD vendor or recycler holds a current authorisation. Authorisations are annual; checking expiry date before every transaction is a basic due diligence step that many procurement teams omit.

Resale vs. Recycle: The Asset Recovery Economics of a Typical Indian Data Centre Exit

A well-sequenced data centre decommissioning project generates meaningful financial offsets. The decision between resale, refurbishment, and recycling for each asset class should be driven by both data security risk and residual market value — and these two factors often pull in opposite directions. Assets with the highest scrap metal value (copper-rich power distribution units, aluminium chassis) tend to be the easiest to wipe, while high-capacity NVMe storage arrays carry the highest data risk and the lowest secondary-market liquidity in India’s current refurbished IT market.

At October 2026 copper scrap rates of approximately ₹720–₹760/kg in Mumbai yards, the copper content of a 42U rack’s power cabling, busbars, and heat sinks contributes meaningfully to recovery value. A standard enterprise server chassis yields roughly 8–12 kg of aluminium and 1.5–2.5 kg of copper per unit. Across a decommission of 200 servers — a mid-sized data centre consolidation — that translates to recoverable metal value of ₹8–₹14 lakh at current rates before recycler processing fees. Add in motherboard gold and palladium content (routed through CPCB-authorised precious-metal recovery facilities) and the total recovery for a 200-server project can approach ₹18–₹25 lakh, net of ITAD and sanitisation costs.

Resale of servers under 5 years old — particularly popular SKUs from Tier 1 OEMs — can command ₹15,000–₹80,000 per unit in India’s refurbished B2B market, depending on specification, condition, and whether a sanitisation certificate accompanies the unit. Buyers increasingly require that certificate; without it, resale value drops by 20–30% in a liability-conscious market. For assets over 7 years old, direct recycling is almost always the superior economic path once refurbishment labour is factored in.

For non-ferrous metal recovery from data centre hardware, our ferrous and non-ferrous metal recycling service provides transparent, LME-indexed pricing with a full audit trail — critical for organisations that need to report asset recovery proceeds in their accounts.

The 8-Point Compliance Checklist for a Data Centre Decommission Project

The following checklist is designed for IT asset managers and compliance officers managing a decommission project in FY 2026-27. It reflects obligations under the three principal statutes — the DPDPA 2023, the E-Waste (Management) Rules 2022, and the Hazardous and Other Wastes Rules 2016 — and the BRSR Core disclosure framework.

1. Complete a CMDB-backed asset inventory before any physical work begins. Every device must have a tag ID, data classification, and age. This list drives every subsequent decision on sanitisation method and disposal route.
2. Classify all media by data sensitivity under your DPDPA data mapping. Devices holding personal data of data subjects require certified sanitisation or physical destruction — not just a factory reset. Document the classification rationale.
3. Commission on-site data sanitisation to NIST SP 800-88 Rev.1 (Purge) standard or physical destruction, with serial-number-level certificates. No hardware may leave the data centre perimeter until a Certificate of Data Destruction is issued for that specific device.
4. Verify your recycler’s CPCB authorisation via the CPCB portal before signing any contract. Check the authorisation expiry date — annual renewals are required. Confirm the recycler’s authorisation covers your specific e-waste categories (IT and telecom equipment, Schedule I of the E-Waste Rules).
5. Generate CPCB-format e-waste manifests for every outbound consignment. Each manifest must record: device type, quantity, weight in kg, recycler’s authorisation number, consignment date, and transporter details. Retain manifests for a minimum of 2 years per Rule 17.
6. Segregate hazardous sub-components — lithium-ion and lead-acid batteries, CRT monitors, and PCBs with heavy-metal content. These require separate manifests and must be routed to facilities authorised under the Hazardous and Other Wastes Rules, 2016 in addition to e-waste rules.
7. Obtain Certificates of Recycling from your authorised recycler for all materials processed. These are distinct from Certificates of Data Destruction. Both documents are required for BRSR Core disclosures and for EPR compliance reporting under the E-Waste Rules.
8. Compile a project closure dossier containing: asset inventory, data classification records, sanitisation certificates, CPCB manifests, Certificates of Recycling, GST invoices for asset recovery proceeds, and a summary report for the CISO, DPO, and CFO. File a copy with the company secretary for BRSR Core purposes.

Related Articles

• Choosing an ITAD Vendor in India: The Due Diligence Checklist That Protects You From Their Breach
• Certificate of Data Destruction: What a Legally Defensible One Actually Contains
• DPDPA 2023 and IT Asset Disposal: Why Deleting Files Is Not Data Destruction

Frequently Asked Questions

Is a data centre operator a “bulk consumer” under the E-Waste Rules 2022, and what does that require?

Yes. The E-Waste (Management) Rules, 2022 define bulk consumers as commercial establishments that use IT and telecom equipment above threshold quantities. Data centre operators — whether operating their own facility or a colocation site — clearly fall within this definition. As bulk consumers, they must ensure all decommissioned hardware is channelled to CPCB-authorised dismantlers or recyclers, maintain manifests for a minimum of 2 years under Rule 17, and deposit e-waste only through authorised channels. Passing hardware to an unregistered scrap dealer is a Rule 22 offence enforceable by the CPCB or State PCB.

What is the DPDPA penalty for a data breach caused by improper hardware disposal?

Under Section 33(2) of the Digital Personal Data Protection Act, 2023, the Data Protection Board of India can impose a financial penalty of up to ₹250 crore per breach incident on a data fiduciary that fails to implement reasonable security safeguards. A hardware disposal event where personal data is subsequently accessed — because media was not properly sanitised — would constitute a breach triggering this provision. The penalty is determined by the Board based on factors including data sensitivity, number of data subjects affected, and the degree of the fiduciary’s negligence.

Do batteries from UPS systems in a decommissioned data centre require separate compliance?

Yes. Lithium-ion and lead-acid batteries from UPS systems are governed by the Battery Waste Management Rules, 2022, which are separate from the E-Waste Rules. They require channelling to CPCB-registered battery waste recyclers, and manifests must be maintained separately. Additionally, large lead-acid battery banks may also attract obligations under the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016, depending on lead content and volume. A project that disposes of UPS batteries through the general e-waste stream without proper segregation is simultaneously non-compliant under two regulatory frameworks.

How long must e-waste manifests from a decommission project be retained?

Rule 17 of the E-Waste (Management) Rules, 2022 requires that records relating to e-waste — including manifests, handover receipts, and recycler certificates — be maintained for a minimum of 2 years from the date of the transaction. For listed companies subject to SEBI’s BRSR Core framework (circular dated 12 July 2023), auditors may request records from the current and immediately preceding financial year. Given that DPDPA enforcement proceedings could extend the relevant period further, retaining records for 3 years is the more defensible approach.

Can decommissioned servers be resold rather than recycled, and what compliance steps apply?

Resale is permissible and often commercially preferable for assets under 5 years old, provided the device has been certified data-sanitised to NIST SP 800-88 Rev.1 or equivalent standard before sale. The sanitisation certificate must accompany the asset. If resold domestically, the transaction attracts GST under the applicable HSN code and must be invoiced accordingly. If exported, the asset is subject to DGFT’s IT hardware re-export regulations. Assets that cannot be certified sanitised must be routed to a CPCB-authorised recycler — they cannot be sold, donated, or gifted without a clear data destruction record.

Work With The National Recycling Corporation

The National Recycling Corporation is a Mumbai-headquartered, pan-India recycling and scrap trading company with specific capability in IT asset disposal, data centre decommissioning, and e-waste compliance. We work with IT departments, procurement teams, and data protection officers across Mumbai, Pune, Delhi-NCR, Bengaluru, Hyderabad, Chennai, and Ahmedabad to deliver decommissioning projects that close cleanly — commercially, legally, and on the compliance calendar.

Our CPCB-authorised e-waste recycling service for data centre hardware includes verified media sanitisation support, serial-number-level asset tracking, CPCB-format e-waste manifests, Certificates of Recycling for every consignment, and Certificates of Data Destruction where on-site destruction is performed. All financial transactions are supported by GST-compliant invoices with the correct HSN classification. Metal recovery proceeds are priced against LME benchmarks for copper and aluminium, with full transparency on the calculation.

For organisations with BRSR Core or ESG disclosure obligations, our documentation package is structured to meet Principle 2 requirements without additional reformatting. Contact us to discuss your decommissioning timeline, asset volumes, and compliance requirements — we will provide a detailed project proposal within 3 working days.

• Pan-India pickup — scheduled within 5 working days for major metros, 10 days for Tier 2 cities
• CPCB-authorised disposal partners across Maharashtra, Karnataka, Tamil Nadu, Telangana, Delhi-NCR, and Gujarat
• GST-compliant invoicing with correct HSN codes for all e-waste categories
• Certificate of Recycling and Certificate of Data Destruction issued per consignment
• BRSR-grade documentation package for listed-company sustainability disclosures
• Fair-market asset recovery pricing indexed to LME for copper, aluminium, and other non-ferrous metals
• Dedicated project manager for data centre decommission engagements above 100 assets

Sources and References

• CPCB E-Waste Portal — E-Waste (Management) Rules 2022 and authorised recycler registry
• Ministry of Environment, Forest and Climate Change (MoEFCC) — E-Waste Rules gazette notifications
• CPCB — Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016
• Ministry of Electronics and Information Technology (MeitY) — Digital Personal Data Protection Act, 2023 implementation
• SEBI — BRSR Core Framework circular dated 12 July 2023
• London Metal Exchange — Copper and aluminium benchmark pricing
• Bureau of Indian Standards — IS/ISO/IEC 27040 Storage Security adoption
• Business Standard and Economic Times — press reports on CPCB e-waste enforcement actions in FY 2025-26 (referenced generically)