Secure E-Waste and Data Disposal: An IT Compliance Guide for Hawaii Businesses

Editor's note: We have rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 and combined several earlier articles on this topic into one guide.

Last updated: October 2026

Secure disposal of old computers, drives, phones, and copiers is an IT compliance requirement in Hawaii, not just a recycling decision. Hawaii law requires businesses to take reasonable measures to protect personal information when they dispose of it, and federal rules add their own disposal duties for financial institutions and health care organizations.

The standard most auditors expect you to follow is NIST SP 800-88, which NIST revised in September 2025. This guide explains what IT compliance in Hawaii requires for data disposal, what changed in the new NIST guidance, what credit unions need to know about NCUA rules, and how to choose a disposal vendor and keep the right proof. If you only remember one thing, make it this: a device is not retired until you can prove the data on it is gone.

Why Data Disposal Is an IT Compliance Issue in Hawaii

Data disposal is a compliance issue because retired devices still hold the same personal information they held in service. A laptop, server, or multifunction copier that leaves your office without proper sanitization is a potential breach waiting to be discovered.

The risk is easy to underestimate. Devices that store data include more than computers:

• Laptops, desktops, and servers.
• Solid state drives, hard drives, and external drives.
• USB flash drives, memory cards, and backup tapes.
• Smartphones and tablets.
• Copiers, printers, and fax machines with internal storage.
• Network equipment that stores configurations and credentials.
• Cloud storage and virtual machines you are decommissioning.

In New York finance, I learned that documentation and reporting are critical. Disposal is a perfect example. The work itself takes minutes per device. The record that proves it was done correctly is what protects you when an auditor, an examiner, or an insurer asks.

What Does Hawaii Law Require for Data Disposal (HRS 487R)?

Hawaii's data disposal law, HRS Chapter 487R, requires any business or government agency that conducts business in Hawaii, or holds personal information of Hawaii residents, to take reasonable measures to protect against unauthorized access to that information during and after disposal.

Under HRS 487R-2, reasonable measures include:

1. Policies and procedures, with compliance monitoring, requiring paper records to be burned, pulverized, recycled, or shredded so the information cannot practicably be read or reconstructed.
2. Policies and procedures, with compliance monitoring, requiring electronic and other non-paper media to be destroyed or erased so the information cannot practicably be read or reconstructed.
3. A written official policy describing the procedures for proper destruction or disposal of personal records.

You can use an outside records destruction company to meet the requirement. The statute expects you to exercise due diligence, sign a written contract, and monitor the vendor's compliance. Due diligence can include reviewing an independent audit of the vendor, checking references, confirming certification by a recognized trade association, or evaluating the vendor's security policies.

There are exemptions. Financial institutions subject to the Gramm-Leach-Bliley Act, health plans and providers that comply with HIPAA, and consumer reporting agencies that comply with the Fair Credit Reporting Act are exempt from HRS 487R. Those organizations are not off the hook. They follow federal disposal requirements instead, which are covered below for credit unions.

Disposal is one half of the picture. If a device is lost or stolen before it is sanitized, Hawaii's breach notification law may apply. Our guide to data privacy compliance and encryption in Hawaii covers HRS 487N and why encryption changes the outcome.

Hawaii's E-Waste Recycling Law

Hawaii also regulates the environmental side of e-waste. The Electronic Device Recycling and Recovery Law, HRS Chapter 339D, requires manufacturers of covered devices sold in Hawaii to register with the Department of Health and run recycling programs. Act 162 of 2025 expanded the covered device list effective July 1, 2025, adding items such as fax machines, household routers and modems, and peripherals like keyboards and power supplies. The Department of Health lists registered collectors and recycling options by county.

The e-waste law is about keeping hazardous materials out of landfills. It does not address data security. A recycler that accepts your equipment is not automatically sanitizing your data, so treat data destruction as a separate step with its own proof.

What Changed in NIST SP 800-88 Revision 2?

NIST SP 800-88 Revision 2, published in September 2025, replaces the 2014 version and shifts media sanitization from device-by-device instructions to an organization-wide sanitization program. It asks organizations to set policy, match methods to data sensitivity, and verify and document the result.

The final Revision 2 supersedes Revision 1. The NIST FAQ on Revision 2 highlights several changes that matter in practice:

• Program over tables. Revision 2 drops the media-specific tables and points to evolving standards such as IEEE 2883 for technique details.
• Broader scope. The term "information storage media" covers cloud and object storage as well as physical devices.
• Multi-pass overwriting is unnecessary. The old seven-pass approach is no longer needed. A single pass or a manufacturer's sanitize command is typically sufficient for clearing.
• Degaussing is a purge technique for legacy magnetic media, not a destroy method.
• Cryptographic erase has prerequisites, including FIPS-validated encryption, at least 128-bit strength, no prior plaintext storage of the data, and proper key zeroization.
• Shredding and pulverizing have limits. NIST says these techniques should be avoided for anything but the lowest security categories of data, and points to methods such as incineration for other media, including SSDs.
• Verification and validation are separate steps. Verification confirms the technique completed without errors. Validation formally confirms the result meets the requirement for that data's sensitivity.
• Certificates of sanitization are part of the documentation a program should define.

If your current policy still says "wipe drives to DoD seven-pass standard," it is out of date. Update it to reference Revision 2.

Clear, Purge, or Destroy: Choosing the Right Method

The right sanitization method depends on how sensitive the data is and whether the device will stay inside your organization or leave it. NIST groups methods into three categories: clear, purge, and destroy.

• Clear uses standard read and write commands, such as overwriting, to protect against simple recovery. It fits devices being reused inside the organization for data of similar sensitivity.
• Purge uses methods that protect against advanced laboratory recovery, such as cryptographic erase, a drive's built-in sanitize command, or degaussing for legacy magnetic media. It fits devices leaving your control, such as returns to a leasing company, resale, or donation.
• Destroy makes the media physically unusable and the data unrecoverable. It fits failed drives that cannot be purged and media that held the most sensitive data.

Modern SSDs are a special case. Because most modern SSDs are self-encrypting, cryptographic erase is often the most reliable purge method, provided the encryption meets the prerequisites above. Simply deleting files or reformatting an SSD does not sanitize it.

Copiers deserve their own line in your policy. The FTC's guide to protecting personal information advises businesses to remove and destroy or overwrite copier hard drives before a leased or owned copier leaves the office. Put that requirement in your lease return process.

NCUA Data Disposal Requirements for Credit Unions

Federal credit unions must properly dispose of consumer information they maintain, under 12 CFR 748.0(c) and the Fair Credit Reporting Act disposal rule at 12 CFR 717.83. NCUA guidance also expects disposal measures to be part of every credit union's information security program.

Here is how the pieces fit together as of October 2026:

• The disposal requirement. 12 CFR 748.0(c) requires each federal credit union to properly dispose of any consumer information it maintains or possesses, as required by 12 CFR 717.83.
• Safeguarding guidelines. Appendix A to Part 748 calls for appropriate measures to properly dispose of member information and consumer information. In December 2025, the NCUA proposed moving Appendix A out of the regulations and into a Letter to Credit Unions, with no substantive change to its content. As of our October 2026 review, Appendix A still appeared in the eCFR.
• Record retention. The NCUA finalized changes to its vital records rule in June 2026, removing Appendices A and B to Part 749, including the record retention guidelines many credit unions used as a checklist. The underlying records preservation program in Part 749 still calls for a schedule for storing and destroying vital records.

The practical takeaway for credit unions is that the record retention appendix is gone, but the need for a board-approved retention and destruction schedule is not. If your disposal procedures cite Appendix A to Part 749, update them. Keep a log of what was destroyed, when, how, and by whom, and have more than one person attest to each destruction.

For the broader picture of NCUA cybersecurity expectations, see our guide to NCUA compliance for credit unions in Hawaii.

How to Choose a Data Destruction and E-Waste Vendor in Hawaii

Choose a disposal vendor that holds recognized certifications, signs a written contract, documents chain of custody, and gives you a certificate of destruction for every job. Those four items line up with what HRS 487R expects for vendor due diligence.

Certifications to look for:

• R2 or e-Stewards for electronics recycling. The EPA notes that both accredited recycling standards require destruction of all data on used electronics and involve ongoing oversight by an accredited certifying body.
• NAID AAA Certification for information destruction. The program is run by i-SIGMA and includes unannounced audits in addition to scheduled reviews.

Hawaii adds a logistics layer. Many recycling streams eventually ship off island, and specialized vendors are fewer here than on the mainland. Things take longer to arrive and longer to leave. That makes it worth planning disposal into your hardware lifecycle instead of handling it as a cleanup project. I prefer to sanitize data before equipment leaves the client's custody whenever possible, so a shipping delay never becomes a data exposure window.

What a Certificate of Destruction Should Include

A certificate of destruction is your evidence that a specific device was sanitized or destroyed. A complete certificate includes:

1. Your organization's name and address.
2. The vendor's name, address, and certification numbers.
3. The date and location of destruction.
4. The method used (clear, purge, or destroy, and the specific technique).
5. An itemized list of devices, with serial numbers or asset tags.
6. Quantity of items destroyed.
7. Chain of custody details, including pickup and transfer dates.
8. A statement that the data was rendered unrecoverable.
9. The signature of the person who performed or witnessed the destruction.

Keep certificates with your asset records for as long as your retention policy and regulators require. In an audit, a certificate that matches the serial number in your asset inventory closes the question immediately.

A Step-by-Step Data Disposal Program for Hawaii Businesses

A working disposal program connects your asset inventory, your sanitization method, and your proof. Use these steps to build one:

1. Write the policy. Define which data classifications require clear, purge, or destroy, and who approves each. Reference NIST SP 800-88 Rev. 2.
2. Track every asset. Record serial numbers when devices arrive, not when they leave.
3. Encrypt devices in service. Full-disk encryption on every laptop and desktop makes cryptographic erase possible at retirement.
4. Collect devices securely. Store retired equipment in a locked area with limited access until sanitization.
5. Sanitize and verify. Perform the approved method, confirm it completed without errors, and record the result.
6. Use a certified vendor for recycling and physical destruction, under a written contract.
7. Collect certificates and match them to your asset inventory.
8. Include paper. Shred or destroy paper records containing personal information through the same documented process.
9. Cover remote staff. Give employees who work from home a clear process for returning devices and disposing of paper.
10. Review the program each year as part of your risk management process in Hawaii, and after any change in regulations or vendors.

This is where lifecycle planning pays off. When we build three to five year technology roadmaps with clients, hardware refresh dates are on the calendar. Disposal can then be scheduled, budgeted, and documented, rather than discovered in a storage closet years later.

Disposal also connects to your broader cybersecurity in Honolulu and statewide. The same asset inventory that drives disposal also drives patching, monitoring, and incident response. Continuous compliance depends on that kind of discipline: dedicated resources, regular assessments, and checking for drift between what the policy says and what is actually happening.

Talk to Intech Pacific About Secure Data Disposal

Intech Pacific helps Hawaii businesses and credit unions build disposal policies aligned with NIST SP 800-88 Rev. 2, track assets through their full lifecycle, and coordinate certified destruction with documentation that holds up to review. If you have a closet of retired equipment or a policy that still references outdated standards, we can help you sort it out. Learn more about our IT compliance services for Hawaii businesses.