Old laptops are a data protection risk. Retire them the DPDP-ready way.
India’s Digital Personal Data Protection (DPDP) Act is now law, and its main obligations apply from 13 May 2027. Every old laptop, PC and server in your storeroom still holds personal data: customer details, employee records, patient files. How you dispose of it is now a compliance question, not just a facilities one.
- Records for every device, ready for your auditor
- Certified wiping or destruction per serial number
- Working devices bought back to offset the cost
Get your DPDP-ready quote
The timeline in one minute
- August 2023 — DPDP Act passed by Parliament
- 13 November 2025 — DPDP Rules notified; Data Protection Board set up
- November 2026 — Consent Manager rules come into force
- 13 May 2027 — core duties apply: security safeguards, breach reporting, and erasure of personal data once its purpose is over
Why IT disposal matters under DPDP
The Act expects organisations to protect personal data with reasonable security safeguards and to erase it when it’s no longer needed. A laptop sold to a scrap dealer with an unwiped drive is a data breach waiting to happen, and penalties for failing to protect data can run up to ₹250 crore.
Separately, the E-Waste (Management) Rules, 2022 require businesses, as bulk consumers, to hand e-waste only to authorised channels. Proper ITAD covers both rules in one process.
What we give your compliance team
- Serialized asset register — every device, by serial number, and what happened to it
- Per-device Certificate of Data Destruction — method, date and technician for each storage device (how we destroy data)
- Chain-of-custody record — from your premises to final processing, with signed handovers
- Recycling certificate — for items processed by government-authorised recyclers
- Optional witnessed destruction — your team watches and signs the record
These records are designed to support your DPDP and E-Waste Rules documentation. Your legal or compliance team decides how they fit your overall programme.
A simple disposal checklist for the next six months
- List every storeroom, branch and site holding retired IT equipment
- Count laptops, desktops, servers, drives and phones waiting for disposal
- Stop any disposal that doesn’t come with per-device data destruction records
- Choose an ITAD partner and agree on the certificate format before the first pickup
- Clear the backlog well before 13 May 2027, then move to scheduled pickups
- File certificates where your auditors and DPO can find them
Frequently asked questions
Does the DPDP Act apply to my company?
It applies to any organisation that processes digital personal data of people in India, whatever its size. If your company keeps customer or employee data on computers, it almost certainly applies.
Is deleting files enough under DPDP?
Deleted or formatted data can usually be recovered. To show that data was actually erased, you need proper erasure or destruction with records for each device.
Will your certificate make us DPDP compliant?
No single document does that. Our records give you evidence that retired devices were handled and destroyed securely, which is one part of a compliance programme your legal team owns.
What about data on devices we’re still using?
DPDP covers that too, but it’s outside IT disposal. We focus on the point where a device leaves your hands.
We have hundreds of devices across branches. Where do we start?
With a count. Book a free storeroom audit and we’ll help you plan a phased clear-out before May 2027. Working devices can be bought back to offset the cost.
May 2027 is closer than your next IT refresh
Clear your storeroom now, with records for every device.
Certificate for every device. Payment within 5 working days of pickup.A named contact replies within 2 working hours.
This page is general information, not legal advice. Please confirm your obligations with your legal or compliance advisor.