The ITAD Documentation Checklist: Every Record Your Auditor Expects

Every question anyone will ever ask about a disposal happens after the hardware is gone. The ICO asking how personal data was destroyed. An ISO 27001 auditor sampling your asset register. A customer security questionnaire asking for disposal evidence. A finance team reconciling the fixed asset register. None of them can inspect the equipment; all of them can inspect the file.

That reframes what you are buying from an ITAD provider. The collection and the destruction are necessary, but they are invisible in retrospect. The documents are the part of the service that persists, which is why the quality of a provider is best measured by the completeness of the record set it hands back. This guide lists that record set, document by document, so you can check any engagement, ours included, against it.

The certificate of data destruction is the keystone record, and the difference between a strong one and a weak one is specificity. A defensible certificate contains:

• Per-serial identification: every drive and device listed by its own serial number, not summarised as a count.
• Method and standard: what was done to each device (verified erasure, degaussing, physical destruction) and the standard applied, such as NIST 800-88 Clear, Purge or Destroy.
• The engineer: who performed and verified the work.
• The date of destruction, not just the date of collection.
• A verifiable reference tying the certificate to the collection, so it can be checked against custody records and, if challenged, confirmed with the issuer.

Whether you are legally required to hold one, and why the practical answer is yes, is covered in our post on whether you legally need a certificate of data destruction in the UK. And because weak certificates circulate widely, it is worth knowing how to verify a certificate is genuine and spot a fake before you rely on one in an audit file.

Data documents prove what happened to the information; waste documents prove what happened to the physical equipment, and UK waste law requires them independently of any data considerations.

A waste transfer note records each movement of non-hazardous waste between parties: what was transferred, when, by whom, and to whom. Check that the description of the waste is accurate, that the parties named are the ones actually doing the work (a mismatch here is how undisclosed subcontracting surfaces), and that your copy is retained with the engagement file.

Some IT equipment is classified as hazardous waste, with items such as certain batteries, older display equipment and some components falling into this category. Hazardous movements require a consignment note with stricter content and retention requirements. If your estate includes anything in these categories and no consignment note appears in your pack, ask why: either the classification or the paperwork is wrong, and both are your problem as the waste producer.

The WEEE regime governs what ultimately happens to waste electrical and electronic equipment: reuse where possible, recovery and recycling where not, through appropriately registered operators. Your file should show that equipment left your control into a compliant WEEE route, not simply that it left your building.

In practice, that means being able to evidence:

• that your disposal contractor is appropriately registered for the waste activities it performs, which you can check on public registers rather than taking on trust;
• where reuse happened: which assets were refurbished and returned to use, the best environmental outcome and usually the best financial one too; and
• where recycling happened: that residual equipment went to authorised treatment rather than landfill or an untraceable export chain.

WEEE evidence is also where disposal meets your sustainability reporting: reuse and recycling figures from a well-documented engagement feed directly into environmental and ESG reporting, which turns a compliance document into a reporting asset.

The reconciliation report is the document that ties everything else together, and it answers the simplest, hardest question in disposal: does everything add up?

The logic is one line long: collected = processed = certificated. Every asset scanned onto the vehicle at your site should appear in the processing records, and every data-bearing device in the processing records should appear on a destruction certificate. The reconciliation report demonstrates that the three lists match, and explains any exception explicitly: a device reclassified on inspection, a drive found inside a machine that was not on the original inventory, an asset your team withdrew before collection.

This is the report that catches the failure mode auditors worry about most: the device that silently disappears between collection and certification. Without reconciliation, a missing drive is invisible until someone else finds it. With it, discrepancies surface within days, while they can still be investigated. If a provider does not offer a reconciliation report, the per-serial certificates lose much of their force, because nothing proves the certificate list is complete.

The core record set is universal, but each regulator reads it through its own lens. Four patterns come up constantly:

• NHS and healthcare: information governance teams need disposal evidence that slots into DSPT submissions and stands up to inspection, with per-serial proof for anything that touched patient data. See our NHS and healthcare sector page.
• Financial services: operational resilience and outsourcing oversight expectations mean firms must evidence control over the disposal chain itself, not just the outcome. See our financial services sector page.
• Education: schools, trusts and universities answer to funders and the ICO alike, often with lean IT teams, so the audit pack needs to be usable without a compliance department. See our education sector page.
• Legal: client confidentiality and privilege mean firms often require witnessed destruction and an unbroken custody record they can show to clients as well as regulators. See our legal sector page.

The fastest way to apply this checklist is to hold your next disposal engagement against it, document by document, before you sign off the invoice. Anything missing is a conversation to have while the provider still wants something from you.

We publish downloadable checklists, certificate explainers and compliance templates in our resources library, free and without a sign-up wall. And if you would rather see the record set than read about it, ask us for a redacted sample audit pack from a real engagement via the contact page: it is the quickest way to calibrate what good looks like.