IT asset disposal DPDP India: a Bengaluru SaaS storeroom and 280 signed certificates

A working story on IT asset disposal DPDP India. One 240-person Bengaluru SaaS firm. 280 retired laptops and 60 retired phones in a storeroom. Nine working hours from the door opening to a signed PO and a per-device certificate flow. The conversations the CFO and the auditor would actually read.

08:55 AM · Whitefield, BengaluruThe storeroom door he had been avoiding

Vikram heads IT at a Series B SaaS firm in Whitefield. 240 employees, three offices, a customer base that includes two Indian banks and an insurer. The refresh batch had arrived on Wednesday. 280 four-year-old laptops, 60 retired Android handsets from the field sales team, and a single line item on the asset register that read “to be disposed.” Vikram had walked past the storeroom twice on Thursday and had not opened the door.

Friday morning he opened it. The pallets had been stacked tidy by the courier. Each laptop still had the original asset tag. Each phone was in a cable-tied bundle of ten. The total replacement cost of the data sitting on those drives, if any one of them was lifted, was a number he had never bothered to compute. He computed it standing in the doorway. Customer KYC pointers on the sales team handsets. Source code repositories cached on the engineering laptops. A pricing model spreadsheet on the CFO’s old machine that was sitting eight rows from the door.

The asset register said “disposed.” The pallets said otherwise.

He opened his notebook and wrote one line at the top. “How do we prove to the auditor in November that nothing from these 340 devices left this building?” Underneath it he wrote a second line. “And how do we prove it before then, not after.”

I have walked roughly forty Indian IT heads through this exact morning since the DPDP rules were notified. The pattern repeats. The refresh batch lands. The procurement story is celebrated. The disposal story is filed under “next quarter.” Then a board observer asks a clean question and the storeroom becomes a compliance problem instead of a logistics one.

10:30 AM · Office cafeteria, third floorThe HR head who said the obvious thing first

Meera runs People Operations. She was already at the corner table with a filter coffee when Vikram sat down. She had clocked his face.

Vikram looked up. Meera had compressed the whole morning into one sentence. She did not say “do certified erasure.” She did not say “get a NAID-AAA vendor.” She said the auditor’s word. Certificate. A piece of paper, signed, with a chain of serial numbers and a date, that the firm could produce on demand.

I keep coming back to this scene with founders. The HR head was right because she heard the question through Shilpa’s ears. The CFO does not buy disposal services. The CFO buys the ability to answer one question from one auditor with one file. Walk into the budget meeting with the question already written down and you usually walk out with the cheque.

12:15 PM · CFO Shilpa’s office, fourth floorThe budget conversation that paid for the rest of the day

Shilpa is the CFO. She had been at the firm for nineteen months and had walked into the room with the same expression she always wore for IT line items. The printout of the FY26 IT spend sat in front of her. She turned the page once and looked up.

Shilpa did the thing CFOs do when they have decided but are not ready to say so. She read the printout for ten seconds longer than necessary. Then she capped her pen.

What just happened, mechanically. Vikram did three things many Indian IT heads do not do. He named the gap precisely. He framed the spend as evidence production, not as another service. He cited DPDP Section 8 and the CPCB rules in the same breath because the auditor will. The CFO signed because the cheque the auditor could read was the same one Vikram had drafted.

14:45 PM · Vikram’s desk, second floorThe vendor call that narrowed the scope

Karthik from Sirius Star called back twenty minutes after Vikram sent the enquiry. He did not open with a pitch. He opened with the inventory file Vikram had attached.

Three things. Certified data erasure to a recognised standard. Verified chain of custody from your storeroom to the recycler’s facility. A serial-numbered certificate of destruction returned to you within five working days of pickup.

Vikram wrote one line in capitals at the top of his notes. “Per-device certificate. Per-device traceability. Per-device price.”

17:30 PM · Vikram’s desk, lights coming on outsideThe auditor’s email that arrived right on cue

The vendor review committee from one of the bank customers sent the quarterly questionnaire at 5:14 PM. Question 11 read, in the standard phrasing the BFSI compliance teams have been using since the DPDP rules dropped. “Please attach evidence of certified data destruction for any of your retired endpoints that processed our customer data in the last 18 months.”

Vikram read it twice. Two hours earlier he would have had no answer. The signed PO sat in Shilpa’s inbox now, the on-site pickup was scheduled for Monday and Tuesday next week, and the certificates would be in his hands by the following Monday. He could write the reply tonight in three lines and attach the executed PO as evidence of programme commencement, with a commitment that the certificates would be forwarded by Day 14.

He wrote the reply. He copied Shilpa. He copied the compliance lead. He copied Meera, because she had earned it. The signed PO came back from Shilpa at 18:42 PM with one sentence at the bottom of her email.

Vikram leaned back. Outside, Whitefield was lighting up in the way it does after 6 PM, when the campus buses start lining up. The storeroom downstairs still held 340 devices. By next Friday it would hold zero, and his filing system would hold 340 signed certificates. The auditor’s November question now had a Day-7 answer.

Buyer’s checklistIT asset disposal DPDP India: the four questions to answer in writing

Before your next standup, answer these four in writing. If you cannot answer any one of them with a number or a date, that is your gap.

• How many retired devices are physically on your premises today, and what data sat on each one when it was retired? Storeroom counts plus the last user roles. Sales handsets carry different evidence than engineering laptops.
• Do you hold a per-device certificate of destruction for every device retired in the last 18 months? Not a batch certificate. Not a recycler invoice. A signed per-serial certificate naming the standard applied. If the answer is “no” for any device that processed customer data, that device is your DPDP exposure.
• Who is your CPCB-authorised recycler and what is the GPS-tracked chain-of-custody record from your storeroom to their facility? A reputable ITAD vendor produces the manifest. A non-reputable one says “we will handle it.”
• What is the OEM buyback path for in-warranty devices in your refresh batch? 30 to 40 percent of a typical batch will qualify. If your disposal proposal does not net those off, you are paying twice.

For the broader compliance picture, pair this with our DPDP readiness checklist for HR and IT teams, our walkthrough on DPDP penalties for Indian SMBs, and our field-tested companion on USB data theft prevention for Indian companies.