Every IT disposal provider will tell you they are secure, certified and environmentally responsible. The website copy is close to identical across the sector, which makes it useless for choosing between them.
These twelve questions are not. They are difficult to answer well without actually running the process, and the shape of the answer usually tells you more than its content.
Chain of custody
1. Who physically collects the equipment?
You are looking for directly employed, vetted staff. If collection is subcontracted, the people handling your data are employed by a company you have not assessed — and that is a third party in your supply chain whether or not anyone has written it down.
2. Where is the equipment itemised?
It should be scanned and logged at your premises, before it moves. If itemisation happens back at the depot, the register records what arrived — which cannot tell either of you whether anything went missing in between.
3. Where is it processed, and by whom?
Ask for the address, and ask whether you can visit. A provider processing in their own facility will say yes without hesitation.
Data destruction
4. What erasure standard do you work to?
You want a specific named standard and a description of how verification works — not the word 'military-grade', which means nothing and appears mostly on websites that would rather not be specific.
5. How do you handle SSDs differently from hard drives?
A good diagnostic question. Solid state drives need firmware-level sanitisation rather than conventional overwriting, and finer shredding if destroyed. A provider who does not distinguish between the two is not thinking about it.
6. Can I have a certificate for a specific serial number?
Pick a device from a previous collection and ask. Real per-device certification means the answer arrives in minutes.
7. Can you destroy on site if our policy requires it?
Even if you do not need it today, the answer tells you whether they own destruction equipment or subcontract the capability.
Compliance and licensing
8. What is your waste carrier licence number?
This should come back immediately, and you should check it on the Environment Agency public register rather than taking it on trust. Your duty of care makes this your responsibility, not a courtesy.
9. Are you registered with the ICO?
Any organisation processing personal data as part of its business should be, and the register is public.
10. What documentation comes with each collection?
The answer should be an itemised asset register, per-serial destruction certificates, and a waste transfer note — as standard, not on request and not at extra cost.
Value and environmental outcomes
11. How is resale value calculated and reported?
Per asset, net of stated costs, reconciled against the register. A single aggregate figure with no breakdown cannot be checked, and therefore cannot be defended if anyone asks you to.
12. Can you evidence your zero-to-landfill claim?
Ask for the weights: how much was collected, how much reused, how much recycled. A provider genuinely operating to the waste hierarchy has these numbers because they are already reporting them to somebody.
Frequently asked questions
At minimum an Environment Agency waste carrier registration and ICO registration, both of which are publicly verifiable. Beyond that, ask what the provider actually does rather than which logos they display — a documented per-device process with real certificates matters more than a badge on a footer.