TL;DR
Ask where your device data lives and most people point at the laptop. The laptop is one of at least five places. The others are your asset register, your management platform, your supplier’s systems and whatever the disposal vendor keeps as evidence. Each sits in a jurisdiction, and almost nobody has written down which.
- The device is one of five places the data reaches. The other four are easy to forget.
- Your asset register holds personal data: names, home addresses, often phone numbers.
- A supplier’s platform may sit in a different country from your supplier.
- Wipe certificates are evidence, so somebody keeps them, somewhere, for years.
- Ask for the hosting location and the sub-processor list, in writing, before signing.
- This is jurisdiction specific. Get local advice rather than copying another company’s answer.
The five places device data actually sits
Most conversations about this start and stop at the machine. That is the easy part, and it is the part your disk encryption already covers.
Here is the full set.
Best tools for Device Management
| Location | What it holds | Who can read it |
|---|---|---|
| The device | Files, caches, saved credentials | The holder, and anybody with the disk |
| Your asset register | Names, addresses, assignment history | Whoever has access to the tool |
| The management platform | Inventory, location signals, policy state | The vendor and its hosting provider |
| Your supplier’s systems | Shipping records, contacts, serials | The supplier and its own subcontractors |
| Disposal evidence | Certificates tying a serial to a date | The disposal vendor, for years |
Rows two and five are the ones teams miss.
Your asset register is a personal data store
Nobody thinks of it that way, because it is full of serial numbers. It is also full of names, home delivery addresses and sometimes personal phone numbers, because that is how the courier reaches somebody.
That makes it a record about identifiable people, sitting in whatever tool you picked and wherever that tool is hosted. If you have ever exported it to a spreadsheet for a board pack, it is in a few more places as well.
Why the location of each one matters
Data protection regimes care where personal data goes, and transfers across borders are treated differently from transfers within them.
In the European framework, the consolidated text of the General Data Protection Regulation restricts transfers of personal data outside the EEA unless specific conditions are met. Other regimes take their own approaches, and several countries have their own rules about data about their residents.
Now apply that to the table above. A European employee’s home address sits in your register. Your register is a tool hosted somewhere. Your equipment supplier holds the same address to deliver the laptop, and its courier partner holds it too.
What this post will not do
It will not tell you what any law requires of you. That depends on where you are established, where your people are, what you are doing with the data and several other things that a blog post cannot know.
What it can do is tell you which questions produce an answer you could act on, and which ones suppliers routinely dodge. Take the answers to somebody qualified in the jurisdictions you operate in.
That is not a disclaimer for its own sake. The common failure here is copying another company’s arrangement because it looked thorough, without checking whether the two companies are in comparable positions.
The questions that produce a usable answer
Disclosure: RemoAsset, named below, is owned by the same people who publish HROpsLab. It is described with its limitations stated, on the same terms as every other supplier. This site takes no vendor money and sells no placements.
Six, and they are all answerable in writing by any supplier that has thought about it.
- Where is the platform hosted? Name the country and the region, not the provider. Many providers operate in several.
- Who are the sub-processors? A current list, not a promise to maintain one. Couriers, warehouses and repair partners all count.
- Which of them see personal data? A courier sees a name and address. A repair partner may see the whole disk.
- How long is each record kept? Separately for shipping records, support tickets and disposal certificates.
- What happens when we leave? Deletion on what timeline, with what evidence, and what is retained because the law requires it.
- Which standard is used for wiping? NIST Special Publication 800-88 on media sanitization is the usual reference and a supplier working to it will say so without being pushed.
Ask all six before signing. After signing they become change requests.
The answer that should worry you
Not a complicated answer. A vague one. “Our infrastructure is globally distributed” tells you nothing and is usually a sign that nobody has mapped it either.
Equally, a supplier that answers instantly and specifically has had this conversation before, which is itself useful information about who else has asked.
The part that outlives the device
Disposal evidence is the longest-lived record in the whole chain, and it is the one nobody plans for.
When a machine is destroyed, somebody issues a certificate. That certificate ties a serial number to a date and a method. It exists so you can prove the device was handled properly, which means it has to survive longer than the device did.
So years after a laptop is gone, a record about it persists at the disposal vendor. If your register linked that serial to a named employee, the two documents together describe a person’s equipment history.
What to settle up front
Agree the retention period for certificates and agree who holds them. The common arrangement is that the vendor keeps its copy and you keep yours, which means two retention policies rather than one.
Agree also what the certificate contains. A certificate listing a serial and a method is evidence. A certificate listing a serial, a method and an employee name is evidence plus a personal data record, and there is rarely a reason for the second.
Where collection, wiping and disposal run through one supplier, that chain has a single retention policy rather than three, which is the practical argument for certified wiping and disposal handled as one process. The honest limit is that consolidating does not reduce what is retained. It reduces how many separate answers you have to chase.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| One country, few staff | Under 50 | Spreadsheet register | No map at all | List the five locations before anything else |
| Hiring across borders | 50 to 200 | One supplier | Transfers unexamined | Get the sub-processor list in writing |
| Customer security review | Any | Questionnaire arrived | Cannot answer hosting questions | Ask the six questions, then answer theirs |
| Several regional suppliers | Distributed | Different vendor per market | Several answers, none comparable | Standardise the questions, not the vendor |
| Disposal audit requested | Any | Certificates on file | Retention undefined | Agree retention and certificate contents |
What to do this month
Four steps, none of which needs a lawyer to begin.
Write the map. One page listing the five locations, what sits in each and which supplier is involved. Most teams discover a sixth location while doing this, usually a spreadsheet somebody exported.
Reduce what you store. Does the register need a personal phone number after delivery? Does it need the home address once the device is issued? Often the answer is no, and removing a field is cheaper than defending it.
Ask the six questions. Of every supplier that touches a device, not only the main one.
Write down who decides. When a question arrives from a customer or a regulator, somebody has to answer within days. Name that person before the question comes.
Where consolidation helps and where it does not
Fewer suppliers means fewer sub-processor lists, fewer retention policies and fewer people holding your employees’ addresses. That is a genuine reduction in surface area, and it is the clearest argument for running procurement, delivery, retrieval and disposal through one chain rather than four.
What it does not do is change where any of it is hosted, or reduce what the law asks of you, or answer the jurisdiction question on your behalf. A single supplier gives you one conversation instead of four. You still have to have it.
For the evidence side of the same problem, our guide to equipment compliance evidence covers what auditors tend to ask for.
See how a single chain handles collection, wiping and disposal at certified data wiping for returned devices, or read our guide to equipment compliance evidence.
Frequently asked questions
Where does device data actually live?
In five places, not one. The device itself, your asset register, your management platform, your supplier’s systems and whatever the disposal vendor keeps as evidence. Most teams only think about the first, which is also the one disk encryption already covers. The register and the disposal records are the two that get forgotten, and both contain information about identifiable people rather than just serial numbers.
Is our asset register personal data?
Usually yes, even though it feels like an inventory. It typically holds names, home delivery addresses, assignment history and sometimes personal phone numbers, because that is how a courier reaches somebody. That makes it a record about identifiable people sitting in whatever tool you chose, wherever that tool is hosted, plus any spreadsheet exports anybody has made for a board pack.
What should we ask a supplier about data location?
Six things, all answerable in writing: where the platform is hosted by country and region, the current sub-processor list including couriers and repair partners, which of those see personal data, how long each record type is kept, what happens to the data when you leave, and which sanitization standard is used for wiping. Ask before signing, because afterwards they become change requests.
How long do disposal certificates stick around?
Longer than the device, by design. A certificate ties a serial to a date and a method so you can prove the machine was handled properly, which means it has to outlive the hardware. Agree the retention period and who holds the copies up front. Also agree what the certificate contains: a serial and a method is evidence, while adding an employee name makes it a personal data record with little added value.
Does using one supplier solve the problem?
It reduces the surface area rather than solving it. Fewer suppliers means fewer sub-processor lists, fewer retention policies and fewer organisations holding your employees’ home addresses, which is a real improvement. It does not change where anything is hosted, reduce what the law asks of you, or answer the jurisdiction question for you. You have one conversation instead of four, and you still have to have it.
Can we just copy another company’s arrangement?
That is the most common way this goes wrong. What applies depends on where you are established, where your people are, what you do with the data and several other factors a blog post cannot know. Two companies that look similar can be in quite different positions. Use the questions here to gather facts, then take those facts to somebody qualified in the jurisdictions you actually operate in.
What is the fastest first step?
Write the map. One page listing the five locations, what sits in each and which supplier touches it. Most teams find a sixth location while doing it, usually an exported spreadsheet nobody remembered. Then reduce what you store: if the register does not need a personal phone number after delivery, removing the field is cheaper than defending it later.
