How to choose an IT disposal company: questions to ask and red flags

Updated 6 November 2026 · By the IT Equipment Disposal team

Short answer: To choose an IT disposal company in the UK, check their waste carrier registration on the public register, ask which data sanitisation standard they work to, confirm you will get a per-device report with serial numbers, and ask where the equipment is treated. Recognised certifications such as ADISA and the NCSC-assured destruction scheme are useful signs. Avoid providers who cannot explain their chain of custody or offer only a generic certificate.

Why the choice matters

When you hand over a laptop or a server, you hand over the data on it, but not the responsibility for it. Under UK GDPR you remain the controller of that personal data, and the disposal company is acting on your behalf. If a drive turns up on an auction site with data still on it, the ICO will ask what checks you made on your provider and what evidence you kept.

Waste law works the same way. Under the Duty of Care, you must take reasonable steps to make sure your waste goes to someone authorised to take it and ends up at a permitted facility. A cheap collection from an unregistered operator can leave you liable for fly-tipping or illegal export, even if you never knew what happened next.

Questions to ask before you book

What is your waste carrier registration number, and which nation's register is it on
Where will the equipment be processed, and does that site hold a permit or exemption for WEEE
Which data sanitisation method and standard do you use, for example NIST SP 800-88
Will I get a report for each device showing the serial number, method and result
What happens to drives that fail erasure
How is equipment secured between my site and yours
Do you use subcontractors at any stage, and if so who
Do you hold any recognised certification such as ADISA or NCSC assured destruction
Can you shred on site if I need it
Will you sign a data processing agreement

A provider that handles data properly will be able to answer every one of these in writing. If answers are vague or arrive only verbally, treat that as a warning.

What good evidence looks like

Document	What it should show
Collection manifest	Number and type of items collected, date, site and signatures
Waste transfer note	Carrier name and registration number, waste description and code, destination
Hazardous waste consignment note	Required in England and Wales for CRT monitors, lead-acid batteries and similar
Erasure report	Drive serial number, software or method, standard, verification result
Certificate of destruction	Serial number of each shredded drive, date and method
Asset report	Each device by make, model, serial and outcome such as resold or recycled

A single certificate saying a quantity of equipment was destroyed, with no serial numbers, is weak evidence. If you are ever asked about a specific laptop, you need to be able to find it on a list.

Certifications worth knowing about

ADISA certification is an independent scheme for IT asset disposal providers that audits their processes, including unannounced checks and forensic testing of processed equipment. Its ICT Asset Recovery Standard has been approved by the ICO as a UK GDPR certification scheme, which gives it particular weight.

The NCSC runs an assured service scheme for destruction, known as CAS-S, used mainly where public sector or sensitive data is involved. Environmental management standards such as ISO 14001 and information security standards such as ISO 27001 are also common. None of these is a legal requirement, but they show a provider has been checked by someone other than themselves.

Red flags

No waste carrier registration number, or one that does not appear on the public register
Free collection of everything regardless of age or condition, with no explanation of how costs are covered
Only a generic certificate with no serial numbers
Unwilling to say where equipment is processed or whether it is exported
Unmarked vans and no paperwork left on the day
Pressure to hand over equipment before a written quote or agreement
Claims that a quick format or factory reset is all that is needed

Free collection is not in itself a red flag. Recent working equipment often has enough resale value to cover costs. The concern is free collection of old, low-value kit with no clear explanation, because the economics only work if corners are being cut somewhere.

Get the agreement in writing

Because the provider is processing personal data on your behalf, UK GDPR expects a written contract that sets out what they will do with it. In practice that means a data processing agreement or contract clauses covering the destruction method, security in transit and storage, use of subcontractors, timescales for processing and the evidence you will receive. Keep it with your certificates. If the provider has no standard agreement and seems surprised to be asked, that tells you something about how often they deal with organisations that take data seriously.

Comparing quotes fairly

Quotes are only comparable if they cover the same things. Check that each one includes collection labour, data destruction for every storage device, hazardous item handling, the paperwork listed above and any resale value. One provider may charge a little more but include on-site shredding of a handful of sensitive drives and a full asset report, which could be worth far more to you than a lower headline price.