Secure IT disposal crucial to prevent data breaches and legal risks

DR. SANDIP CHATTERJEE
SR. ADVISOR - SERI, USA, AND FORMER SR. DIRECTOR & GROUP COORDINATOR - MEITY, GOI

"After my MeitY tenure, I joined SERI USA, focusing on sustainable electronics and the critical issue of IT asset disposition. Over the past decade, India’s digital push—driven by infrastructure like DigiLocker, BharatNet, and UPI—has propelled our economy to $4 trillion, with 25% of that growth powered by digital innovation. But this growth comes with responsibility. We’ve created a data-driven economy, yet we must ensure that our progress remains inclusive, affordable, and sustainable. As we shift from an IT-based to an AI-driven economy, our electronics are becoming more resource-intensive—phones now use up to 69 elements from the periodic table. But even the best refineries can recover only a fraction of those. This material limitation, coupled with increasing e-waste, demands that we prioritize refurbishment before recycling and promote circular use of electronics.

The real danger lies in data: we wrongly assume that formatting or deleting removes it, but 60% of global devices still leak sensitive information after disposal. In India, 71% of tested devices retained recoverable data—banking info, Aadhaar details, even passports. I helped draft the DPDP Act, which will hold companies accountable with penalties up to ₹250 crore, but until its rules are finalized, we rely on moral obligation. That’s not enough. From Morgan Stanley’s $60 million fine to India’s local vulnerabilities, it’s clear—improper data disposal is a massive threat. Techniques like degaussing, overwriting, or cryptographic erasure must be applied based on device type, especially since many physical destruction methods are ineffective or outdated. Simply hammering a hard drive won’t protect you anymore.

What we need is adherence to global best practices—standards like R2 certification that ensure traceability, compliance, and proper sanitization. This isn't just about protecting privacy—data loss is business loss. Studies show 94% of companies suffering severe data loss never fully recover. We must make secure IT disposal the norm, not the exception. France already mandates refurbishment before recycling—we should, too. Our goal should be sustainability with accountability: maximize the life and value of devices, follow global regulations like GDPR and NIST, and ensure secure, eco-friendly IT practices. If we care about how we use technology, we must care just as much about how we retire it."