How to Verify a Certificate of Data Destruction Is Genuine (And Spot a Fake One)

How to Verify a Certificate of Data Destruction Is Genuine (And Spot a Fake One)

Somewhere in your organisation's records there is a Certificate of Data Destruction. It has a company logo, a reference number, a date and something that looks like an authorised signature. It was filed away and everyone moved on.

Here is the uncomfortable question nobody asks: does anyone actually know whether it is real?

Not fraudulent in the criminal sense necessarily. Just, in the eyes of a regulator, an insurer or a procurement auditor, worthless. Because a certificate issued by a company that was not legally permitted to collect your waste in the first place does not become valid simply because it has a nice letterhead. It is a document, not evidence.

The good news is that verifying one properly takes about ten minutes, costs nothing, and uses publicly accessible registers that anyone can search. Here is exactly how to do it.

Key takeaways

• Any company collecting business IT equipment for disposal must hold an Environment Agency upper tier waste carrier licence. If they do not, any certificate they issue carries no weight.

• The Environment Agency public register is free, searchable by anyone, and takes under a minute to check.

• Upper tier registrations start with CBDU. Lower tier registrations start with CBDL and do not permit carrying waste belonging to others.

• Accepting a photocopy of a certificate is not verification. Certificates can be forged or expired. Always check the register directly.

• Your dated record of having checked is the actual due diligence evidence, arguably more important than the certificate itself.

Why this matters more than it sounds

Auditors, regulators, and insurers increasingly scrutinise certificates of destruction, and fraudulent or inadequate certificates can leave your business exposed. Any company collecting and transporting business IT equipment for disposal must hold an Environment Agency upper-tier waste carrier license, verifiable online at the Environment Agency Public Register. If they are not registered, they are operating illegally and any certificate they issue is worthless.

That last sentence is the whole point. A certificate is only as good as the legal standing of the organisation that issued it. If your disposal vendor was never licensed to carry your waste, the paperwork they gave you does not retroactively make the disposal compliant. It just documents, in writing, that an unlicensed operator took your data-bearing equipment away.

The consequences are severe: ICO fines can reach £17.5 million, plus civil liability, reputational damage, contract breaches, and insurance claim denials for non-compliant disposal. Insurance claim denial is the one that catches organisations out most often. An insurer investigating a data breach claim will absolutely check whether your disposal chain was legally compliant. Discovering it was not, after the breach, is the worst possible moment.

Check one: search the Environment Agency public register

This is the single most valuable check and it takes about thirty seconds.

Go to the Environment Agency public register at environment.data.gov.uk. Search by company name or registration number. If you have the carrier's CBDU reference number (format: CBDU12345), use that, as it is the most reliable identifier. The search is completely free and takes less than 30 seconds.

The register is maintained by the Environment Agency in England and Wales, the Scottish Environment Protection Agency (SEPA) in Scotland, and the Northern Ireland Environment Agency (NIEA) in Northern Ireland, and is publicly accessible and free to use, containing license type, registration number, and expiry date. If your vendor operates across borders, check the relevant register for the region where collection actually takes place.

If the company does not appear at all, or the details on the register do not match what is printed on your certificate, stop there. Everything else on the document is academic.

Check two: confirm it says upper tier, not lower tier

This is the check most people miss entirely because it requires knowing the distinction exists.

The Environment Agency issues two tiers of waste carrier licence. If you are hiring a company to remove your waste, they should hold an Upper Tier licence. A Lower Tier licence only covers a business carrying its own waste, not waste belonging to others. If a company offering waste removal only has a Lower Tier licence, that is a red flag.

Carrier numbers often start with CBDU followed by digits for the upper tier, and CBDL for the lower tier. One letter is the entire difference between a legally permitted collection and an illegal one. A company holding only a CBDL registration collecting your IT equipment is not authorised to do so, regardless of what their certificate says.

Check three: confirm the registration is still current

Review the result and confirm the registration is current. An expired registration means the carrier is operating illegally.

Registrations lapse. A company that was properly licensed when you first engaged them three years ago may not be licensed today, and unless someone checks periodically, nobody in your organisation will know. Re-check the Environment Agency register at each renewal reminder, and when onboarding any new carrier.

Check four: request the actual ISO 27001 certificate, not the logo

A logo on a website is not certification. If the certificate claims ISO 27001 or other certifications, verify these by requesting a copy of the current ISO certificate directly from the provider.

What you want to see is the actual certificate document: the certificate number, the issuing certification body, the scope of certification and the expiry date. Then check that the scope actually covers the service you received. An ISO 27001 certificate covering a company's head office information management does not necessarily cover their data destruction operations at a processing facility.

A compliant provider sends this within minutes of being asked. Hesitation, delay or deflection here tells you something.

Check five: confirm every serial number is listed

This is where most inadequate certificates fail, and it is entirely within your control to insist on.

A certificate stating that "47 laptops were securely destroyed on 14 March" is not evidence for a specific device. If a former employee asks what happened to their laptop, or an ICO investigation asks about a specific machine, a batch-level certificate cannot answer the question. You need the serial number of every data-bearing device individually listed, matched against your own asset register.

Serial-level certification is the difference between a document that answers a regulator's question and one that raises further questions.

Check six: screenshot and date your check

This step is arguably the most important and takes ten seconds.

Keep a dated log of each check. Screenshot the register result or note the date, carrier name, CBDU number, and status. This is your evidence of due diligence if challenged.

The logic here matters. Your certificate proves what the vendor claims they did. Your dated verification record proves that your organisation took reasonable steps to confirm the vendor was legitimate before handing over data-bearing equipment. Under UK GDPR accountability principles, demonstrating that due diligence is a separate obligation from holding the certificate itself. One without the other is an incomplete position.

One extra check worth running: sub-contractors

A common mistake is not checking sub-contractors. Your main waste contractor may sub-contract collections to another company.

If your vendor uses third-party logistics for collection, the company physically taking your equipment may not be the company named on your certificate. Ask directly: who is collecting, are they the same legal entity as the certificate issuer, and if not, are they separately licensed? A compliant provider answers this without hesitation. It is a reasonable question and any professional operator expects to be asked it.

The five instant red flags

If any of these appear, treat the certificate as unverified until proven otherwise.

No listing on the Environment Agency register, or details that do not match the certificate.

A CBDL lower tier licence when the company is collecting waste on your behalf.

Certificate lists quantities or batches rather than individual serial numbers.

No named destruction standard. Vague phrasing like "securely wiped" or "professionally destroyed" without naming NIST SP 800-88 Rev. 2 or an equivalent recognised standard.

Reluctance to provide the actual ISO certificate PDF when asked directly.

What to do if a certificate does not check out

If you discover a certificate from a previous disposal does not verify, the situation is recoverable but requires honesty about what you can and cannot claim.

Document what you have found and when you found it. Note which disposals are affected and roughly how many devices. Establish what data classification those devices held. If any held personal data and the disposal chain cannot be verified, this may be reportable, and that assessment should involve your DPO or legal advisor rather than being resolved informally.

For future disposals, run the six checks before the first collection rather than after, and keep the dated verification record on file alongside the certificate. Going forward, the checks take ten minutes. Retrospectively fixing an unverifiable disposal chain takes considerably longer.

Retire your IT. Recover its value. Prove it is gone.

We would encourage you to run every check in this article against NanoSoft before engaging us, and against any other provider you are considering. Our Environment Agency registration and ISO 27001 certification are both independently verifiable, and we provide certificate numbers and documentation on request rather than expecting anyone to take a website logo on trust.

Contact NanoSoft: services@nanosoftltd.com | 0800 677 1344 | Unit 8 & 9 Maldon Trade Park, Heybridge, Maldon CM9 4LJ, UK