ITAD for Banks and NBFCs: What Regulated Entities Should Document
For a bank or NBFC, retiring IT is not an admin task. It is a control that auditors test. The question is never just whether the devices were disposed of. It is whether you can prove, device by device, what happened to the data on them.
This guide lists what regulated entities in India should document, and the equipment that most often slips through.
Why regulated entities are different
Banks and NBFCs hold customer financial and identity data at scale. The Reserve Bank of India's Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued in November 2023, sets expectations for how regulated entities govern IT and information security, and internal and external auditors test those controls. The Digital Personal Data Protection Act, 2023 adds a duty to erase personal data once its purpose is served. The DPDP Rules were notified on 13 November 2025, and most duties of data fiduciaries apply from May 2027.
In practice that means disposal records get read by people whose job is to find gaps.
The documents to keep
| Document | What it shows | When |
|---|---|---|
| Asset disposal policy | Who approves disposal, which methods apply to which media, onsite or offsite rules | Reviewed yearly |
| Approved retirement list | Which assets are being retired, signed by the asset owner | Before collection |
| Vendor due diligence file | The vendor's certifications, authorisations, agreements and audit rights | Before first job, refreshed yearly |
| Serial-level handover list | Every device and drive serial that left, signed by both sides | At collection |
| Erasure reports | Per-drive proof of software erasure with verification | After processing |
| Certificate of Destruction | Method and date for every serial | After processing |
| Form 6 manifest and recycling certificate | Legal movement and recycling of the hardware | At collection and after processing |
| Register update | Retired assets closed against the certificate | After reconciliation |
Branch equipment people forget
Head office laptops are usually well controlled. Branches are where gaps appear, because equipment is retired in ones and twos over years. Watch for:
- CCTV recorders holding weeks of footage of customers and cash areas.
- Biometric attendance and access devices holding staff fingerprints.
- Passbook printers, token machines and branch servers.
- Hard drives inside ATMs and cash recyclers, where the bank owns them.
- Multifunction printers that store scanned KYC documents.
A simple rule helps: anything with storage that leaves a branch goes on the same serial-level list as a laptop.
Vendor due diligence
Treat the disposal vendor like any other vendor that touches data. Ask for the processing company's ISO/IEC 27001 certificate, its e-waste registration on the CPCB portal and State Pollution Control Board consent to operate, the erasure software it uses and a sample report, confirmation that serials are recorded at your site, and an onsite destruction option. Put a right to audit in the agreement. Check whether your outsourcing and third-party risk policies classify the vendor, and file the result.
When something goes missing
Reconciliation will sometimes show a device on the retirement list that is not on the certificate. Do not let it sit. Record it in an exceptions log with the date found, the asset owner, what data it held and what was done: located, reported or written off under your incident process. An exceptions log with closed items reads far better in an audit than a clean register nobody can explain.
