Decommissioning & Data Destruction.

Same hierarchy as private users, but with documentation requirements:

1. Wipe the data — with a certificate. The risk is no longer 'someone might recover a photo'; it is 'are you GDPR-compliant'. The standard is NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization). Every drive that leaves the organisation needs a sanitisation certificate referencing the level applied (Clear, Purge, or Destroy).

2. Cascade to donation channels where possible. A 5-year-old corporate laptop is often a digital-inclusion non-profit's primary inventory. Multiple Luxembourg programs (Digital Inclusion among them) take corporate donations at scale — often picking up by truck, providing tax receipts and tracking documentation.

3. ITAD only for true end-of-life. When the device truly cannot serve another role, IT Asset Disposition (ITAD) partners handle dismantling, material recovery, and the documentation needed for environmental audit (waste manifests, material-recovery reports).

Each step has audit consequences. Get step 1 wrong and you have a data breach. Skip step 2 and you waste resources. Skip step 3 properly and you have an environmental compliance hole.

ITAD (IT Asset Disposition) partners handle the physical end-of-life: pickup from your premises, secure data destruction, dismantling, material recovery, and reselling whatever still has value. They are not all equivalent. The certifications below are the minimum bar for corporate use:

• ISO 14001 (environmental management) — the partner's own operations are documented and audited for environmental impact. Without this, you cannot defend the environmental side of your decommissioning.

• ISO 27001 (information security) — the partner's own operations are documented and audited for information security. Without this, GDPR liability for any breached data follows you, not them.

• NIST SP 800-88 sanitisation certificates per device — written confirmation that each drive was sanitised, to which level, by which technician. The audit trail that makes data destruction defensible.

• R2 (Responsible Recycling) or e-Stewards certification — global ITAD certifications covering downstream tracking. Confirms that the materials you hand over don't end up in informal recycling streams overseas.

What to ask for in the RFP: copies of the certifications, sample audit reports, sample sanitisation certificates, and the downstream supply-chain map (where do the materials actually go after dismantling).

Devices that are no longer suitable for your fleet often still have years of useful life for someone else. The carbon math says: one donated device avoids one new device's manufacturing footprint downstream (~250 kg CO₂e per laptop), assuming the recipient would otherwise have bought a new or refurbished one.

In Luxembourg, the primary corporate donation channel is Digital Inclusion Luxembourg (digital-inclusion.lu). They accept corporate bulk donations, will pick up by truck for larger volumes, and provide tracking documentation that can support tax receipts.

What they want:

• Working laptops, desktops, monitors, tablets, smartphones recent enough to still receive security updates.
• Drives wiped to NIST 800-88 Clear or higher (they re-image anyway, but you must do this for GDPR compliance).
• Volume preferred — they have the logistics for 20+ devices in one drop.

What they cannot use:

• Devices > 8–10 years old (too old to install modern Linux comfortably).
• Devices with non-functional displays, motherboards or batteries that can't be replaced economically — those go to ITAD.

Other cascade paths: schools, training NGOs, employee-buy-out programmes (one-time discount sale to staff at end of cycle), regional refurbishers who buy ex-corporate fleet stock in bulk.

A serious ITAD partner sends quarterly material-recovery reports. They identify, by mass, what was recovered from the devices processed: aluminium, copper, plastic, glass, lithium, cobalt, gold, silver, rare earths.

From a typical laptop, current technology recovers:

• Aluminium chassis at near 100 %.
• Copper in cables and traces at ~95 %.
• Gold and silver in connectors and IC pins at ~70–80 %.
• Lithium and cobalt in batteries at ~50–70 % (rising as EU Critical Raw Materials Act incentivises recovery infrastructure).
• Rare earths (neodymium, dysprosium) at <30 % — current technology, improving slowly.

The material recovery report supports two things: CSRD reporting (Scope 3 lifecycle disclosures, see Lesson 5) and the corporate sustainability narrative. 'We decommissioned X devices, recovering Y tonnes of aluminium, Z kg of copper, A grams of gold' is the language that survives an audit. 'We sent them to a recycler' is not.

Lessons 1–4 covered the operational side: what to buy, how to keep it in service, how to dispose of it. The last lesson covers the reporting and compliance side — turning all this operational discipline into defensible disclosures, KPIs that an auditor would accept, and alignment with the EU regulatory pipeline arriving in 2026.

Lesson 5 — Reporting & Compliance covers what to measure, how to report it, and which EU instruments (CSRD, ESRS E1+E5, Right to Repair, Critical Raw Materials Act) require what from the IT lifecycle.