A Tokyo financial services firm retired 200 laptops. Six months later, customer data was sold on the dark web. The cost: APPI fines, legal liability, customer notification, and reputational damage.
ITAD (IT Asset Disposition) is the secure disposal of obsolete IT equipment governed by data protection laws, environmental regulations, and commercial licensing requirements in Japan.
What Is ITAD and Why It Matters
ITAD encompasses inventory, data sanitization, physical disposal, and documentation ensuring data security and regulatory compliance.
APPI creates strict data protection obligations. Organizations face fines up to ¥100 million or 1% of annual revenue, plus criminal penalties.
The kobutsusho kyoka (古物商許可), or secondhand goods dealer license, is required for any business handling used electronics. Using unlicensed providers creates legal liability.
Japanese Regulations Governing ITAD
APPI: Data Protection Requirements
APPI requires "necessary and appropriate measures" to protect personal data during equipment retirement. Simply deleting files is insufficient. Organizations must document equipment processed, methods used, and destruction dates.
Kobutsusho Kyoka: Secondhand Goods Dealer License
Required for any business handling IT equipment. Working with unlicensed providers creates legal problems and typically means improper data destruction.
The ITAD Process: Step-by-Step
Asset Inventory and Classification
Begin with comprehensive inventory capturing asset tags, serial numbers, and configurations. Different equipment requires different handling.
Data Sanitization and Destruction
Software-based wiping overwrites storage media.
Cryptographic erasure destroys encryption keys.
Physical destruction (shredding, crushing, degaussing, incineration) is most secure.
NIST 800-88 provides detailed guidance.
Verification and Documentation
After destruction, verify and document. Documentation includes a certificate specifying equipment processed, methods, and dates. Retain for 7 years.
NIST 800-88: The Gold Standard
NIST SP 800-88 defines three categories:
Clear overwrites data—appropriate for low-risk scenarios.
Purge makes data recovery infeasible. For magnetic drives: secure erase and degaussing. For SSDs: cryptographic erasure. Appropriate for most business ITAD.
Destroy physically damages media. Appropriate for highly sensitive data.
Ten Criteria for Choosing an ITAD Provider
- Kobutsusho Kyoka verification
- NIST 800-88 compliance
- On-site vs. off-site options
- Chain of custody documentation
- Certificate of destruction
- Environmental certifications
- Insurance coverage
- References
- Reporting and audit support
- Cost transparency
---
About AKRIN
AKRIN K.K. provides NIST 800-88 compliant ITAD services. Contact us for a free assessment.
---
Related Articles
- NIST 800-88 Japan: Data Sanitization Compliance Guide
- Secure Data Wiping Japan: Methods and Compliance
- Kobutsusho Kyoka and ITAD: Why Your Provider Needs a License
---