A server decommission is not a recycling job with a data step attached. It is a data job that ends in recycling. Every drive, every RAID set and every controller with onboard flash leaves your building either sanitized to a documented standard or destroyed, and the paperwork proving that is the product you are buying.
#What the rules actually require
If the servers ever held health information, the HIPAA Security Rule requires you to "implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored." If they held consumer information, the FTC's Disposal Rule requires "reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal," and gives as an example "destruction or erasure of electronic media containing consumer information so that the information cannot practicably be read or reconstructed." Financial institutions under the FTC Safeguards Rule also carry a written procedure requirement for secure disposal of customer information.
None of those rules names a brand of shredder or a wiping tool. They require a defensible method and a record. The reference most auditors use for the method is NIST Special Publication 800-88 Revision 1, which defines media sanitization as "a process that renders access to target data on the media infeasible for a given level of effort."
#Sanitize or destroy
Two honest options. Sanitize when the hardware has resale or reuse value and you accept a software or firmware process on each drive, verified and logged per serial number. Destroy when the data is sensitive enough, the drives are old enough, or the volume is large enough that per-drive verification is not worth the time. Solid-state drives change the calculation: methods built for spinning disks do not necessarily remove data from flash, so ask the recycler which method they use for SSDs and get that method named on the certificate.
#Chain of custody, from rack to record
The decommission you can defend later has five records: an inventory with serial numbers and asset tags before anything is unracked; a signed collection manifest at the dock; a destruction or sanitization record per drive; a disposition record for the chassis and remaining components; and the certificate of destruction that ties them together. Ask for all five before you pick a vendor.
#Before the pickup
Export your asset list with serial numbers. Mark leased units and anything under a buy-back. Decide who unracks: the recycler can, but rack keys, cage access and after-hours windows have to be arranged. Photograph the racks before and after. Batteries in rack UPS units are a separate stream; see how to dispose of UPS batteries in Georgia.
#The Georgia angle
Georgia has no state statute that governs business server disposal. The obligations above are federal and contractual, and they apply in Atlanta exactly as they do anywhere else. What Georgia does add is the practical layer: the state publishes no approved-vendor list, so the records you keep are your proof. Background is in our Georgia e-waste regulations guide.
Need it collected? American Resources picks up business electronics across metro Atlanta, destroys data-bearing media before anything is processed, and closes every job with a certificate of destruction and a manifest of what was collected. Request an electronics recycling quote or send a rough inventory through the contact form.
