What a Los Angeles Data Center Decommissioning Plan Should Include, Section by Section

The facilities lead has a date. It is printed in the lease amendment; it is September 30, and it does not care that the migration slipped twice. The suite is on a downtown floor with four rows of cabinets, a dozen carrier circuits, two UPS systems, and a few hundred drives that nobody has counted in a while. In February, she is asked for "the decommissioning plan," and what she actually has is a spreadsheet, a vendor's phone number, and a feeling.

I ran colocation operations for long enough to see that version of the project many times. The plan that works is not a slide or a meeting. It is a written document with named sections, a named owner on each section, and an output that someone outside IT (the landlord, the auditor, the privacy lawyer) can pick up and read without a guide. What follows are the sections I would want in that document if the site is in Los Angeles, in the order you can paste them into your own template.

A Few Terms Before the Template

A decommissioning plan is the written schedule and set of decisions for shutting down, removing and disposing of IT equipment at a site, ending with the space handed back and the records closed. It is different from a migration plan, which moves workloads; the decommissioning plan starts when the workloads are gone.

A data-bearing asset is any device that can hold user data after the power is removed. In practice, that means hard drives, solid-state drives, tape, and a few things people forget, such as the flash in storage controllers and the configuration memory in switches and firewalls.

The surrender date is the date by which the space has to be returned in the condition the lease or colocation agreement describes. It is often earlier than the end of the term, and it is the date the whole plan works backward from.

The Plan, as Numbered Sections

1. Scope and the Dates That Cannot Move

Start the document with the dates you do not control, because they decide everything else. That means the surrender date, the notice period in the colocation agreement, the notice periods for cancelling power circuits and carrier circuits, and any date the landlord has set for a walk-through. Write each one down with the clause it comes from.

Then write the scope in plain sentences: which rooms, which cabinets, which equipment stays (moved to another site or returned to a lessor), and which equipment goes. If some of the servers are leased rather than owned, note it here, because leased hardware usually goes back to the lessor under its own return terms, and those terms do not always say what happens to the drives inside.

2. A Serial-Level Asset Register

The register is the spine of every later section. One row per device, with the cabinet and rack position, make, model, serial number, asset tag, owner (yours, leased, or the carrier's), and a column that says whether it is data-bearing and with what media type.

Do not build this from the CMDB alone. Walk the cabinets, scan the serials, and photograph each cabinet front and back before anything is unplugged. Every gap you find in February is a gap you do not have to explain in October.

3. Data-Bearing Assets: Sanitize, Sell or Destroy

This is the section that carries the legal weight, so it deserves the most pages.

California puts the disposal duty on the business that owns the records. Civil Code section 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information by shredding, erasing or otherwise making that information unreadable. Hiring a vendor does not move that duty off your desk; it only changes who does the physical work.

The second statute is the one that people tend to discover too late. Under Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, a business has to notify affected California residents within 30 calendar days of discovering a breach of unencrypted personal information, or of encrypted information when the key was also taken.

A pallet of unwiped drives that goes missing between the dock and the processing facility can fall under that rule. So the plan should state, for each class of drive, whether it is encrypted, where the keys live, and how long the drive is readable while it is out of your hands.

The CCPA adds a private right of action under section 1798.150 when nonencrypted personal information is taken because a business did not maintain reasonable security, which is one more reason to keep the readable window short.

The decision itself is sell or destroy, and it should be made per drive class, not as one blanket rule:

• Working enterprise drives of a recent generation still have resale value, but only after a verified wipe. That means an overwrite with a verification pass for spinning drives, a manufacturer secure erase or a cryptographic erase for solid-state drives, and a per-serial report showing the result.
• Failed drives, drives that will not complete a wipe, and drives from your most sensitive systems go to physical shredding. A drive that cannot prove it was wiped should not be sold.
• Tape and spinning drives are magnetic media. Solid-state drives are not, so degaussing does nothing to them, and the plan should not list degaussing as a method for flash.

The practical problem is moving several hundred readable drives out of a shared building without a gap in the record. Each handoff (cabinet to cart, cart to dock, dock to truck) is a place where a serial can go missing.

In the Los Angeles area, Big Data Supply handles data center decommissioning with on-site or off-site hard drive shredding, a certificate of destruction tied to each drive serial, and truck pickup across Los Angeles, Orange County, Riverside, and San Diego, under R2v3 and RIOS certification.

Whoever you use for data center decommissioning in Los Angeles, the plan should name the method per drive class, where destruction happens, and what document comes back for each serial.

4. Building Access and Logistics

A lot of Los Angeles colocation lives in buildings that were never built for it. One Wilshire, at 624 South Grand Avenue, is a 30-story office tower finished in 1966 that became one of the most connected interconnection points in the western United States, and it was not designed for a whole suite of equipment leaving at once.

Write down, from the building's own rules and not from memory:

• Loading dock and freight elevator reservation windows, how far ahead they must be booked, and whether heavy moves are restricted to nights or weekends.
• The largest truck the dock accepts, and whether a 42U cabinet fits in the elevator upright.
• Certificate of insurance requirements for every vendor, with the exact additional insured names.
• Escort, badge and tool policies, and whether the building requires its own electricians or specific trades for work on power.
• Seismic anchoring: in most Los Angeles rooms the cabinets are bolted to the slab or to a braced floor, and removing anchors (and patching the holes) is a line item, not a detail.

Traffic is a scheduling input too. A truck leaving downtown at four in the afternoon is not making a second stop that day. Plan pickups for early mornings or for the building's after-hours window.

5. Power, Cooling and Cross-Connects

De-energizing is its own method of procedure. The plan should say who turns off each circuit, in what order, and who confirms it is dead before anyone touches a whip. Cancelling power circuits with the colocation provider usually requires written notice, and the billing often runs until the cancellation is processed, so the order goes out on a date the plan names.

Cross-connects are the item that most often gets forgotten. List every circuit ID, the carrier, the notice period and the date the disconnect order goes in. UPS battery strings belong in this section as well, because they are moved and handled separately from the IT load.

6. Waste Classification and Who Can Take It

In California, discarded electronic devices are managed as universal waste, which is a type of hazardous waste. They cannot go in a construction dumpster or the building's trash. The handlers who collect and recycle them have their own duties to the Department of Toxic Substances Control; DTSC's handler requirements include a one-time Notice of Intent filed at least 30 days before handling e-waste from off-site, annual reports due February 1, and staff training. The plan should name each receiving handler and recycler, record that they are notified with DTSC, and say which material goes to which of them.

Keep the categories separate on paper: data-bearing media, non-data-bearing IT hardware, batteries, cabling and metal, and anything that belongs to the building.

7. Lease Return Condition

Read the restoration clause and copy its requirements into the plan. Some leases want raised floor, cable tray, and supplemental cooling removed; others want them left in place. Note who patches anchor holes, who removes overhead cabling, and the date of the landlord walk-through. Keys, badges, and access cards go on a list with a return date as well. This section is short in the document and long in the field.

8. The Closeout File

The last section describes what the finished project leaves behind. It should list the reconciled asset register with a disposition on every row, a certificate of destruction or wipe report for every data-bearing serial, the chain-of-custody records for each pickup, the handler and recycler receipts, settlement records for anything sold, written confirmation of circuit cancellations, and the landlord's signed acceptance of the space. Decide now where it is stored and for how long.

Somebody will ask for it during an audit or a security questionnaire years after the people who ran the project have left.

Who Owns Each Section

A plan with no owners is a wish list. This is the split I would start from, adjusted to how your company is organized.

Frequently Asked Questions

How early should a Los Angeles decommissioning plan start?

Work backward from the surrender date and the longest notice period in your contracts, which is usually a carrier circuit or a power cancellation. In my opinion, four to six months ahead is reasonable for a single suite, and longer if the equipment is spread across several buildings or the building only allows heavy moves on weekends.

Does losing a drive in transit count as a data breach in California?

It can. Section 1798.82 applies to unencrypted personal information acquired by an unauthorized person, and to encrypted information if the key was also acquired. If the drive held customer personal information and was not encrypted or wiped, treat the loss as a possible notification event and involve counsel. The 30-day clock runs from discovery.

Can we sell used enterprise drives instead of shredding them?

Yes, if the drive completes a verified wipe and the wipe is documented by serial number. Working enterprise drives of a recent generation usually still have buyers, so shredding them throws away value for no security gain. Failed drives, drives that will not finish the wipe, and drives from systems your security team classifies as highest sensitivity should be shredded instead.

Do we need a specific type of recycler in California?

Electronic devices are universal waste in California, so whoever collects and recycles them should be a handler that has notified DTSC and files the required reports. Ask for that status in writing, and ask where the material goes after it leaves your dock.

One Last Note on the Document Itself

If a section cannot name its owner and its output, it is not finished, and the surrender date will not move to wait for it.