How Ohio businesses should dispose of old computers and electronics
Ohio businesses should treat retired computers as both a data risk and a waste stream. Personal information left on a discarded device can trigger breach notification under ORC 1349.19, documented disposal supports a cybersecurity program under the Ohio Data Protection Act, and CRT displays from businesses are regulated waste. Public e-waste drop-offs are generally for residents only.
The data side: breach notification
Ohio's breach notification law, ORC 1349.19, requires businesses and agencies to notify Ohio residents when computerized personal information is accessed or acquired without authorization, generally within 45 days of discovery. The Ohio Attorney General enforces it. A laptop sold, donated or dumped with readable customer or employee data on it is exactly that kind of exposure.
The Ohio Data Protection Act
ORC 1354.01 to 1354.05 give businesses an affirmative defense in certain data breach lawsuits if they maintain a written cybersecurity program that reasonably conforms to a recognized framework such as the NIST Cybersecurity Framework. Media disposal is a standard control in those frameworks, so per-device sanitization records are part of the evidence that your program actually operates.
The waste side: monitors and CRTs
Business electronics fall under Ohio EPA hazardous and universal waste rules. Older cathode-ray tube (CRT) monitors and TVs contain leaded glass; the household exemption that applies to consumers does not extend to businesses. Broken CRTs headed for disposal carry specific requirements under Ohio Administrative Code 3745-51-39.
Why the county drop-off isn't an option
In Central Ohio, SWACO's recycling convenience center and collection events are limited to residents. Businesses need a commercial outlet that can document what happened to each device.
A practical checklist
- Inventory what is leaving: device type, serial number and asset tag
- Remove devices from MDM, Autopilot and Apple Business Manager, and release activation locks
- Decide wipe or destroy per device class, in writing
- Use a provider that records sanitization per serial number and returns a certificate
- File the certificate with your security program records
Related
This guide is general information, not legal advice. More resources.