Green ITADUK IT recycling directory
Menu
Guide for businesses

Choosing an ITAD provider: a checklist

Eleven things to check before you hand over your organisation’s old IT: licences on the public registers, where the equipment goes, paperwork, data sanitisation, contracts, certifications, reuse, green claims and costs.

Checked 7 October 2026 · Sources

Steel mesh cages stacked three high and full of old computers at a recycling site
Computers collected for recycling in steel mesh cages · Photo: Tom Worthington, CC BY-SA 3.0

Before you start

Use the registers, not copies of certificates: almost every licence below can be checked online. On Green ITAD, a solid verified badge shows that we have already found it on the official register or list, and when.

The checklist

  1. Waste licences, checked on the register. An upper-tier waste carrier (or broker) registration — check it with the Environment Agency, Natural Resources Wales, SEPA or NIEA, and in England check the expiry date. Then the processing site’s permit, licence, T11 or EASR registration. If they say they’re an AATF, check the number and status on the regulators’ lists. See T11, ATF and AATF.
  2. Where the equipment goes. Ask for the full chain of downstream sites and their permits — especially anything exported, and whether anything is exported at all.
  3. Paperwork. A waste transfer note (or a reuse contract if the equipment stays equipment rather than waste); hazardous waste consignment notes for things like CRT screens and some batteries, with consignee returns every quarter in England; and an asset-level report listing serial numbers. See duty of care.
  4. How data is sanitised. Which standard they follow (NCSC guidance, NIST SP 800-88 Rev. 2, IEEE 2883); whether erasure is verified; whether drives that fail or can’t be wiped are destroyed to a stated particle size, such as 6 mm or less; and whether you get a certificate of sanitisation or destruction for each serial number. See standards explained.
  5. A data protection contract. An Article 28 processor contract covering your instructions, confidentiality, security, sub-processors and audit rights. Can you audit or visit the site? See data protection.
  6. Independent certification, checked with the issuer. ADISA ICT Asset Recovery Standard 8.0 and its DIAL level, or ITAD Essentials (on the ADISA register); NAID AAA (in the i-SIGMA directory); ISO 27001 and ISO 14001 certificates and what they cover (UKAS CertCheck); Cyber Essentials or Cyber Essentials Plus (IASME search). Watch out for lapsed certifications — ADISA publishes a lapsed list.
  7. Chain of custody and security. Vehicle tracking and security, vetted staff, sealed containers, secure storage, and on-site shredding or erasure if you need it.
  8. Reuse first. Do they refurbish and resell or donate equipment before recycling it? Do they share the resale value? Do they follow BS EN 50614, the standard for repairing and refurbishing WEEE?
  9. Environmental claims. Ask for the evidence behind any “zero to landfill” or carbon claims. See how to judge zero to landfill claims.
  10. Company checks. Look the company up on Companies House: is it active (not dissolved or in liquidation), how long has it traded, and where is its registered office? A UK company must show its company number on its website.
  11. Costs and logistics. What’s free and what’s charged? Are there minimum quantities, collection areas or times? Can you drop equipment off? Check on the company’s own website or ask for a quote.

What certifications do and don’t cover

  • ISO 27001 shows a company runs an information security management system. It doesn’t prove a particular erasure method works — check that the certificate covers the processing site, not just the head office. ISO itself certifies no one: certificates are issued by certification bodies.
  • Cyber Essentials covers five basic controls on the company’s own IT (firewalls, secure configuration, security updates, user access and malware protection). It says nothing about how they wipe your drives.
  • AATF approval is about the producer recycling system, not data security.

Find companies by service, by licence or certification, or near your postcode.

Sources

  1. Defra: Waste duty of care code of practice
  2. GOV.UK: Access the public register for environmental information
  3. GOV.UK: Hazardous waste — consignment notes and consignee returns
  4. GOV.UK: When EEE becomes waste (WEEE)
  5. NCSC: Secure sanitisation of storage media
  6. NIST SP 800-88 Rev. 2
  7. ICO: What needs to be included in the contract?
  8. ICO data protection audit framework: asset management
  9. ADISA Certification: search for a certified company
  10. NCSC: Cyber Essentials overview
  11. ISO/IEC 27001
  12. GOV.UK: WEEE evidence and national protocols guidance (BS EN 50614)
  13. Companies House: find and update company information

This guide is general information, not legal advice. Rules differ between England, Wales, Scotland and Northern Ireland — check with the regulator or an adviser for your situation.