A leased equipment return sends hardware back to the lessor at the end of the term without sending your data with it. Every server, storage array, and switch going back still holds whatever it held the day it was powered off, so the return means reading the lease, deciding on the drives, documenting every device, and scheduling backward from lease end.
That gap is not an oversight on the lessor's part. The lease governs the hardware. Your obligations for the data on it come from somewhere else entirely: your own policies, customer contracts, privacy law such as the FTC Disposal Rule, and whatever regulatory regime applies to your industry. None of those obligations transfer to the lessor when the truck pulls away.
What Does the Lease Require at Return?
Most equipment leases require the asset to come back complete and in working order, with normal wear excepted. "Complete" is the clause that matters. If the lease treats drives as part of the asset, removing and destroying them turns a return into a partial return, and the lessor will bill for the missing parts, usually at a replacement or list price rather than what the drives are actually worth on the secondary market.
Some leases address this directly with a drive-retention option. You keep the drives, pay a fixed fee per drive or per unit, and return everything else. Others allow retention only if it was elected at signing. Some are silent, which in practice means the lessor's return team decides after the fact.
Look for three other terms. The notice period for return, since missing it can roll the lease into month-to-month holdover rent. The required return condition for configuration, since some lessors want equipment reset to factory defaults and will charge to do it themselves. And any clause requiring a certificate of data sanitization, which is increasingly common and places the burden on you to produce it.
Should You Sanitize the Drives or Keep Them?
There are two defensible approaches, and the choice is mostly economic.
Sanitizing in place means the drives go back with the equipment after a licensed contractor or your IT team has rendered their contents unrecoverable. NIST SP 800-88 defines the categories that matter here. Clear uses standard read and write commands to overwrite user-addressable storage and protects against simple, non-invasive recovery. Purge uses techniques such as block erase, cryptographic erase on self-encrypting drives, or sanitize commands built into the drive firmware, and protects against laboratory recovery attempts. For media leaving your control permanently, purge is the appropriate target for anything carrying sensitive data. Destroy is off the table if the drives are going back.
Retaining the drives means you pay the lessor's fee and send the media to destruction under your own control. It removes any question about whether sanitization succeeded, and for organizations whose policy requires physical destruction of media that held regulated data, it may be the only compliant option.
The deciding factors are the per-drive retention fee, the number of drives, the time available before lease end, and whether your data classification policy even permits reuse of the media outside your organization. If policy says physical destruction, the lease economics do not change the answer.
Where Else Does Data Live Besides the Drives?
Drives are not the only place data lives.
Servers keep configuration and credentials in the baseboard management controller: iDRAC, iLO, XClarity, and their equivalents retain user accounts, network settings, and sometimes certificates. Storage arrays hold configuration, replication partner details, and cached data in controllers and NVRAM. Switches and firewalls carry full configurations with passwords, SNMP communities, and VPN keys in startup config. RAID controllers can hold cache contents. Some appliances store logs on internal flash.
Each of these needs a documented reset by your IT team or a licensed contractor. A factory reset of the management controller and a write-erase of network device configuration should be on the same checklist as the drives, with the same sign-off.
Document It Like a Disposal
A lease return is a disposition event from a data perspective, and the paperwork should look like one.
For every asset leaving, record the asset tag, the chassis serial, and the serial of every drive, whether it is going back or being retained. For drives sanitized in place, record the method, the tool and version, the date, the operator, and the verification result. NIST 800-88 expects verification, and a sanitization record with no verification step is a record of an attempt.
For drives retained and destroyed, the destruction vendor's certificate should list drive serials individually. A certificate of destruction that says "48 hard drives" without serials cannot be reconciled against the inventory and will not satisfy an auditor asking about a specific device.
Keep the lessor's signed receipt for returned equipment alongside the sanitization records. Together they close the loop: this device, sanitized by this method, verified, shipped on this date, received by the lessor.
When Should You Start Planning a Lease Return?
At least one quarter before the term ends, working backward from the lease end date. Timing is where lease returns go wrong. The lease end date is fixed; everything before it has to fit.
Decommissioning comes first, and it takes longer than people plan for. Workloads have to be migrated off, applications confirmed retired, and data retention requirements checked, because equipment subject to a legal hold cannot be sanitized regardless of the lease date. Only then can sanitization begin.
Sanitization itself takes real time on large drives. Overwrite passes on high-capacity spinning disks run for many hours per drive, and a failed drive that will not complete a purge has to be pulled and handled as a destruction case, which may trigger the lessor's missing-parts charge. Cryptographic erase on self-encrypting drives is fast, but only if the drives were deployed with encryption enabled in the first place.
Then comes packing, return authorization, and pickup scheduling, which run on the lessor's calendar rather than yours.
Build the schedule backward from the lease end with slack for failed drives and late pickups. A structured decommissioning program handles the physical deinstallation, packing, and staging in sequence once your IT team has migrated workloads and the wiping has been performed by a licensed contractor or your IT team, and an ITAD provider can manage retained media and any equipment you own outright that is leaving at the same time.
Start the conversation with the lessor about drive retention at least one quarter before the term ends. It is a negotiation, and negotiations go better when the other side is not already holding the equipment.