When a school retires its Chromebooks, the work often begins with counting devices, checking their condition, and arranging a collection. There is another question that deserves just as much attention: what happens to the information stored on them?
Chromebooks rely heavily on cloud services, but they can also store information directly on the device. Before equipment is sold, donated, reassigned, or recycled, schools need a reliable way to protect that information—and a record showing that the process worked.
Even when your team has already reset the devices, a few questions remain. Was every Chromebook included? Did each reset finish successfully? What happened to the devices that would not turn on?
These are the gaps a properly managed IT asset disposition program helps close.
Our guide to IT asset disposition for schools covered this at a high level. Here, we’ll focus on Chromebooks specifically, including where Powerwash, deprovisioning, and encryption fit into the process.
What Information Can Remain on a Chromebook?
Even when students and staff primarily use Google Workspace, some information may be stored locally. Depending on how the Chromebook is configured and used, this can include:
- Downloaded documents, photos, and email attachments.
- Files saved for use without an internet connection.
- Browser history, cookies, and information used to maintain signed-in sessions.
- Data stored by Android apps or Linux applications, where enabled.
These records may contain student information, staff documents, or other sensitive material.
The practical takeaway is simple: a Chromebook should be treated as a device that holds data, even when most of its work happens in the cloud.
Does Removing a Chromebook from Management Erase Its Data?
Deprovisioning releases a Chromebook from the school’s management environment. During that process, Google Admin Console allows the administrator to choose whether to factory-reset the device or keep its existing data and user profiles.
That means a device can be deprovisioned without its local user data being removed. Google also notes that deprovisioned devices remain listed in their organizational unit even though they are no longer managed.
For a school preparing equipment for collection, two separate questions need answers:
- Has the Chromebook been released from management?
- Has its local data been successfully sanitized?
Selecting a reset option is part of the process. Confirming that it completed on the correct device is just as important.
What Does Powerwash Actually Do?
Powerwash is more than deleting visible files. Google describes it as performing cryptographic erasure, which clears the keys needed to read encrypted information.
Think of encryption as protecting information with a key. When the necessary keys are properly sanitized, the protected information becomes inaccessible, even if encrypted remnants remain on the storage.
Google explains that some diagnostic and operational information can survive Powerwash. Files stored in cloud services also remain outside the local reset’s scope. Neither point, by itself, means that a previous user’s local documents can still be recovered.
Powerwash can therefore be a legitimate part of sanitization. However, a school still needs evidence that the process was appropriate and completed successfully on every device being retired.
Why Encryption Alone Is Not the Whole Answer
Encryption helps protect information while a Chromebook is in use. Cryptographic erasure takes the additional step of sanitizing the keys that make the protected information readable.
Its effectiveness depends on how encryption and key management are implemented, whether the sensitive information was covered by that protection, and whether the necessary keys were successfully sanitized. NIST addresses these conditions in its media sanitization guidance.
That does not mean schools should assume Chromebook encryption is easily broken. It means that “the device is encrypted” is not enough information to establish that its data has been properly sanitized.
The more immediate concern during a large refresh is often a gap in the process: a device missed during collection, a reset that failed, or damaged equipment set aside without a documented outcome.
For example, a district might prepare 500 Chromebooks for retirement, with several arriving from classrooms after the main batch was reset. Those late additions need the same attention as every other device. An assumption that “the whole lot was wiped” can leave them unaccounted for.
What a Certified ITAD Provider Adds
An IT asset disposition provider should be able to explain what happened to each device from collection through final disposition.
R2v3 and NAID AAA certifications provide independent oversight of relevant operations. SERI’s R2v3 guidance emphasizes safeguards, traceability, and accountability in sanitization. NAID AAA includes scheduled and unannounced audits of security practices, including chain of custody and employee screening.
For schools, that should translate into a practical process:
- Identify and track the devices received.
- Keep equipment secure during transportation, storage, and processing.
- Apply an appropriate sanitization procedure.
- Check the results and investigate failures.
- Document the final outcome before releasing equipment for reuse.
Schools should also confirm that the provider’s current certification scope covers the services and media involved. A certification logo alone does not explain which operations have been assessed.
At OEM Source, data-bearing devices and storage media received for disposition go through our sanitization process even when the client reports that they have already been wiped. This provides another controlled step between the school’s internal preparation and the equipment’s next use.
A client’s earlier reset is useful preparation. Every received device still needs an accountable, documented outcome.
How Is Sanitization Different from Deleting Files?
Deleting a document, clearing a Downloads folder, or performing a quick format does not automatically establish that all sensitive information has been addressed.
Sanitization aims to make access to the target data infeasible at a defined level of effort. NIST SP 800-88 Revision 2 describes three methods:
- Clear: Protects against recovery through ordinary access to storage.
- Purge: Protects against more advanced recovery techniques and can allow storage to remain usable.
- Destroy: Physically sanitizes storage and makes it unusable.
The appropriate method depends on the information, device, storage technology, and intended disposition.
Schools do not need to become storage specialists. They need a provider that can explain the method selected, why it is appropriate, and how the result is confirmed.
The accurate description is a process aligned with NIST SP 800-88 Revision 2. NIST does not certify sanitization vendors or software under this guidance.
What Happens to Broken or Locked Chromebooks?
A Chromebook that will not start or allow someone to sign in may still contain sensitive information. A damaged screen, failed motherboard, or management lock does not establish that its storage has been sanitized.
These devices need a defined exception process. Some may be repaired or released from management so sanitization can be completed.
If the data-bearing storage cannot be successfully sanitized via certified data erasure and the result validated, OEM Source routes it for appropriate physical destruction. The process must address the actual storage components; damaging a screen or enclosure is not sufficient.
Where storage is removed, the records should connect that component to the Chromebook it came from. This allows the school to account for the original device and the outcome of its data-bearing media.
What Documentation Should a School Receive?
During a large refresh, a general statement that “everything was wiped” leaves too many questions unanswered.
Ask your provider for:
- An inventory: Device serial numbers reconciled against the equipment received.
- Chain-of-custody records: Documentation of equipment transfers and handling.
- Sanitization results: The method used, completion status, and any failures.
- Exception outcomes: What happened to devices that could not complete the normal process.
- Certificates: Sanitization or destruction records linked to the relevant devices or storage components.
A certificate should be supported by processing records. Together, they should allow your team to follow each asset from receipt to its final outcome.
These records help schools answer a straightforward question: can we account for every device and explain what happened to its data?
Protecting Data Can Also Preserve Value
Secure disposition does not always require destroying a working Chromebook.
When sanitization is successful and the device remains suitable for use, repair, refurbishment, resale, or donation may extend its useful life. Software support, condition, processing costs, and market demand all influence the options.
This can help schools reduce unnecessary waste and recover value where practical. Equipment that cannot be reused still needs appropriate data handling before it enters the recycling process.
Plan Before the Next Refresh
The best time to agree on data handling is before devices leave the school. Establish the inventory, sanitization requirements, management-release responsibilities, exception process, and reporting expectations early.
OEM Source helps schools coordinate these steps through secure collection, inventory reconciliation, NIST-aligned sanitization, testing, repair, and documented reporting. Our R2v3 and NAID AAA certifications support our commitment to secure, accountable processing.
Whether your team has already reset its Chromebooks or needs help planning the entire project, the goal is the same: every received device is accounted for, every data-bearing component is appropriately processed, and the results are documented.
Until sanitization or destruction has been completed and validated, treat every retired Chromebook as potentially containing sensitive information.
Contact OEM Source to plan your next Chromebook refresh with clear procedures for protecting data, handling exceptions, and identifying opportunities for reuse and value recovery.
