For law firms, IT asset disposal isn’t an option; it is a compliance obligation. Outdated equipment like laptops, hard drives, servers, and smartphones can hold sensitive client information, making secure disposal mandatory for law firms.
According to ABA’s Legal Technology, 27% of lawyers reported their firms had experienced a security breach, including incidents involving lost or stolen computers and smartphones.
Lawyers also have an ethical duty to protect client information. ABA Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of information relating to a client’s representation.
But what makes IT asset disposal so important for law firms? The risks go beyond losing a device. Let us give you an overview of why equipment disposal is important in a law firm.
This blog explores key ethics, compliance requirements, and security considerations law firms should keep in mind when choosing an ITAD services partner.
Why IT Asset Disposal Matters in Law Firms?
IT equipment disposal affects more than data security alone. For law firms, it can also influence ethical responsibilities, client security expectations, and the firm’s ability to document how retired assets were handled.
Retired Devices Can Still Expose Clients’ Information
75% of attorneys rely on cloud computing for work-related tasks, up from 69% in 2023.
As more legal work adapts to the digital landscape, the number of endpoints that may breach data also grows. This makes asset disposal a non-negotiable for legal workers.
A device like a laptop or smartphone that is no longer used may still contain sensitive information. Disposal therefore not only deals with the physical asset, but also the data that is stored on it.
Clients Require Law Firms to Demonstrate Security
Clients and prospective clients may want to know the protocols a firm practices to safeguard information. Security isn’t something that a law firm needs to address internally.
According to a survey, 27% of respondents had been asked by a client or potential client for their firm’s security requirements or guidelines. Among firms with more than 100 lawyers, that figure reached 50%.
Environmental and Operational Security
IT equipment disposal isn’t just about getting old equipment out of the office. The 2024 Global E-waste Monitor reported that 62 billion kg of e-waste was generated worldwide, but only 22.3% was formally collected and recycled.
There is also value to recover: the same e-waste contains an estimated 31 billion kg of metals worth about $91 billion. So, when eligible equipment is securely wiped before resale or reuse, firms can protect their data while getting some value back from assets they no longer need.
On the technical side, NIST SP 800-88 Rev. 2 provides guidance on sanitizing storage media before devices are reused, recycled, or discarded. So, simply deleting files or sending old equipment to a recycler isn’t enough. Secure IT asset recycling means law firms keep retired devices under control while ensuring they are responsibly reused, resold, recycled, or discarded.
What to Look for in an ITAD Partner (Under Rule 5.3)
ABA Model Rule 5.3 requires lawyers to make reasonable efforts to ensure that nonlawyers, including outside vendors, act consistently with their professional obligations. In simple terms, hiring an ITAD provider does not mean the firm can stop paying attention to how that provider handles client information and retired equipment.
In other words, engaging an ITAD provider does not mean the firm is free from responsibility to see how the service provider handles the retired equipment and clients’ data.
Here is what a law firm should check before handing over its IT assets. Start with these areas:
Verified Data Destruction and Sanitization
As part of law firm data destruction compliance and oversight under Rule 5.3, verify that the provider uses appropriate data sanitization and destruction methods and understand how those methods are selected for different media types. Hummingbird follows NIST SP 800-88-aligned sanitization practices and can use approved physical destruction methods, including hard-drive shredding, when destruction is required.
Proof of Destruction and Audit Records
A service provider cannot simply say that the assets were destroyed or sanitized. It should provide documented evidence of what happened to each asset.
It should present documented evidence of what happened to each asset. This way, law firms can verify that the ITAD provider executed the process as agreed, which is an important part of Rule 5.3.
Compliance documentation like a certificate of destruction, asset reports, serial numbers, sanitization records, and chain-of-custody can provide the firm with an audit trail and ensure the process was performed as agreed upon. Professionals in this field provide full proof of destruction and audit records to maintain transparency.
Insurance and Liability
Review the provider’s insurance coverage and contractual liability. According to Rule 5.3, the firm should also understand how responsibility is allocated when an outside provider handles the client information or firm property.
The agreement should explain who is responsible for assets and data at every stage. Stages include collection, transportation, processing, and destruction. For a law firm that deals with confidential client information, this is important to check before handing over the first device.
Learn More: What NAIC Data Security Model Law Requires from Insurance Companies & ITAD Vendors
Ethical Considerations
ABA Model Rule 1.6 requires lawyers to protect confidential client information, while Rule 1.1 calls for competent representation, including keeping up with relevant technology. Rule 1.15 covers the safekeeping of property and can also matter when client or firm assets are being handled during disposal. These obligations are part of what a firm needs to consider when selecting and overseeing an ITAD provider under Rule 5.3.
Together, these responsibilities mean firms need to ensure retired equipment is handled securely from the moment it leaves their control until its final disposition.
Apart from Rule 5.6, the following two points are practical considerations when hiring an asset disposal partner.
End-to-End Chain of Custody
A reliable equipment disposal partner like Hummingbird should be able to track equipment from the moment it leaves the law firm until its final disposition. Asset-level tracking, serial-number records, chain-of-custody documentation, and clean handoff records are a few measures that can help track the equipment at every stage.
Also see how the provider handles equipment recycling pickup, loading, transportation, and storage, and whether employees and other personnel involved in the process are subject to appropriate security controls.
Certifications and Security Standards
Certifications can help a law firm evaluate whether an ITAD provider has established processes for security, quality, environmental management, and worker safety.
The ITAD Agreement Checklist Under Rule 5.3: Why It Matters
An ITAD agreement is a contract between a law firm and its ITAD provider. It defines what the provider will do with the retired equipment, how data will be protected, who is responsible for the assets, and what proof the firm will receive. It matters because once equipment leaves the firm’s premises, responsibilities need to be clear.
A real-world example is Morgan Stanley, where the SEC found that retired IT assets were sold with customer information still on some devices. The case resulted in a $35 million SEC penalty in 2022.
Learn More: Did You Know that Illegally Disposing of E-Waste in Pennsylvania can Land You in Jail?
The agreement should clearly mention:
- ☐ Scope of ITAD services
- ☐ Asset and data identification
- ☐ Chain-of-custody procedures
- ☐ Data sanitization and destruction requirements
- ☐ Subcontractor disclosure and approval
- ☐ Personnel access and security controls
- ☐ Asset-level tracking and documentation
- ☐ Certificates of destruction and sanitization records
- ☐ Incident notification requirements
- ☐ Compliance and confidentiality obligations
- ☐ Audit and oversight rights
- ☐ Asset return or final disposition procedures
- ☐ Record retention requirements
- ☐ End-of-contract responsibilities
- ☐ Allocation of responsibilities between the firm and ITAD provider
Conclusion
For law firms, partnering with an IT asset disposal provider is a lot more about getting rid of old equipment. Instead, it is more about protecting client data and ensuring every device is handled according to protocols. Under ABA Model Rules 1.6 and 5.3, law firms are responsible for protecting client information and overseeing the outside companies they hire.
Before signing an ITAD agreement, firms should ensure it clearly explains how equipment will be handled at every step, from pickup to transportation to data destruction to final disposal.
Frequently Asked Questions
What is the role of NIST SP 800-88 in IT asset disposal?
NIST SP 800-88 Rev. 2 gives guidelines for sanitizing storage media so that data cannot be accessed before assets are reused, recycled, or discarded. Law firms can use the guideline to ensure that an ITAD provider uses appropriate sanitization methods according to different media types.
Should my law firm use on-site data destruction, or on-site data destruction?
On-site destruction is suitable if a firm wants to observe the process directly, while off-site services are suitable for processing large volumes of equipment. Also, the decision depends on various factors, such as sensitivity of the information, the firm’s security requirements, the media involved, and the provider’s controls.
What should my law firm do if an ITAD provider reports an incident?
The ITAD agreement should include an incident response plan and the reporting rules. In case an incident is reported, the firm should find out which devices and information were affected, when the incident happened, and what the provider is doing to fix the problem. The firm should also see if the incident needs to be reported to authorities.
When should a law firm select physical destruction instead of sanitization?
Physical destruction is the right choice when media is damaged, cannot be reliably sanitized, or the firm requires permanent destruction because of the sensitivity of the information. The chosen method should be documented and appropriate for the type of media.
