How to Choose an ITAD Provider in the UK (2026 Checklist)

ITAD quotes are easy to game because the buyer rarely sees where the corners get cut. A low headline price can hide subcontracted couriers, batch-level paperwork, undisclosed resale of your assets, or drives that sit unwiped in a warehouse for weeks. None of that shows up on the invoice. It shows up later, in an audit that cannot be passed, a tender question that cannot be answered, or a data incident traced back to a device your records say was destroyed.

Under UK GDPR your organisation remains the data controller for every byte on those devices until it is verifiably destroyed. The disposal contractor is your data processor, and the accountability principle means you must be able to demonstrate that you chose that processor with appropriate care. A cheap quote you cannot defend is not a saving. It is a liability with a delivery date you do not get to choose.

The good news is that vetting an ITAD provider properly takes an afternoon, not a project. The ten checks below are all verifiable before you sign anything.

Work through these in order. Each one is a factual check, not a judgement call, and a serious provider will volunteer the evidence before you finish asking.

• 1. Verifiable registers. Waste carrier registration, Companies House record, ISO certificate numbers and certification body names should all be checkable on public registers, not just printed on a brochure. We publish ours, with links to every register, on our compliance and licences page, and any provider should be able to do the same.
• 2. Per-device certificates, not batch paperwork. A certificate that says "40 drives destroyed" cannot prove that any specific drive was among them. Insist on certificates listing each serial number individually.
• 3. A named erasure standard. The certificate should state the sanitisation method and the standard it follows. NIST 800-88 is the reference standard cited across UK public-sector guidance. "Military-grade wipe" is a marketing phrase, not a standard.
• 4. A witnessed destruction option. Whether or not you ever use it, the offer matters. A provider that can shred drives at your premises in front of your staff has nothing to hide about its process.
• 5. No-subcontractor chain of custody. Ask who physically collects, transports and processes your assets. Every handoff to a third party is a gap in the custody record, and it is your organisation that answers for the gap.
• 6. An audit-pack SLA in writing. Certificates, custody records and the reconciled inventory should arrive within a defined number of working days, stated in the contract, not "when processing is complete".
• 7. Insurance evidence. Ask for current proof of public liability and professional indemnity cover appropriate to the data risk being carried, not just vehicle insurance.
• 8. Value-recovery transparency. If assets are resold, you should see what sold, for how much, and what your share was. A provider that will not show resale figures is pricing your assets into its margin.
• 9. References from your sector. Disposal evidence requirements differ between an NHS trust, a law firm and a school. Ask for references from organisations that answer to the same regulator you do.
• 10. A site-visit offer. You should be welcome to visit the processing facility, announced or otherwise. Reluctance to show you the floor where your data-bearing assets will sit is an answer in itself.

Every item on this list maps to a document you can file. If you want the full record set an auditor will eventually ask for, our companion guide covers it: the ITAD documentation checklist.

The fastest vetting tool is a short list of direct questions. Good providers answer them in specifics; weak ones answer them in reassurance. Here is the pattern to listen for.

None of these questions is confrontational. If asking them feels awkward, remember what is in the van: your employees' and customers' personal data, on hardware you will never see again.

Certification logos are useful shorthand, but only if you know what each one actually covers. ISO 27001 certifies an information security management system: it tells you the provider runs documented, independently audited security processes. ISO 14001 covers environmental management, which matters for the WEEE and recycling side of disposal. Neither logo, on its own, proves that your particular drives were destroyed.

The UK ITAD sector also has UK GDPR-approved certification schemes and independent industry certifications aimed specifically at secure data destruction and asset recovery. Membership of a reputable scheme is a genuinely positive signal, because it means the provider submits to audits designed for this exact industry.

The mistake is treating any certification as the end of due diligence. A logo tells you the company passed an audit; it does not tell you what happens to your specific assets. Per-device evidence beats any badge, because a certificate listing your serial numbers is proof about your data, while a certification is proof about the company in general. Ask for both, and weight the evidence over the logo whenever they seem to disagree.

You rarely need a formal tender to choose well. A structured comparison of two shortlisted providers, run over a week, surfaces almost everything a procurement exercise would.

• Send both the same brief. Asset counts, locations, data sensitivity, deadlines and the evidence you need at the end. Differences in the questions they ask you back are your first data point: the provider that asks about data-bearing devices and access constraints is thinking about the job, not the invoice.
• Ask both for a sample audit pack. A redacted pack from a real engagement shows you exactly what your auditor will see. Compare the certificates line by line against the checklist above.
• Compare like for like on value recovery. If one quote is cheaper but silent on resale proceeds, the difference is probably your equipment. Ask both to state what happens to resaleable assets and how proceeds are reported.
• Check both on the public registers. Ten minutes on the Environment Agency and Companies House registers, plus the certification bodies' own verification pages, settles most claims either way.

If you are comparing providers for a specific industry, our sector pages set out what disposal evidence each regulator expects, which makes a useful scoring rubric for the comparison.

Once you have chosen, the contract should lock in everything the sales conversation promised. A fair ITAD agreement is short, specific and auditable. Look for these clauses before signing.

• Named deliverables. Per-serial destruction certificates, chain-of-custody records, waste documentation and a reconciled inventory, each named individually, not bundled as "compliance documentation".
• A delivery SLA for the audit pack, in working days from collection, with a named contact responsible for it.
• A data processing agreement reflecting UK GDPR processor obligations, including breach notification timescales.
• A no-subcontracting clause, or if subcontracting is genuinely unavoidable for a specific leg, prior written approval and full custody documentation for it.
• Value-recovery terms: how resale proceeds are calculated, reported and paid, with your right to see the underlying sales figures.
• Liability and insurance commensurate with the data risk, stated in figures rather than adjectives.

A provider that resists putting any of this in writing is telling you how the engagement will go. For a fuller picture of what a mature engagement looks like end to end, see our ITAD service page, which describes the process we contract to.