When disposing of redundant IT hardware, you need specific paperwork to satisfy auditors and prove compliance with UK GDPR and the WEEE Regulations. The exact documents depend entirely on whether the asset holds data and whether it contains hazardous materials. Match your hardware to the table below to see the exact certificates you must hold on file.

Required Documents by Asset Type

Use this reference table to determine the compliance documentation required for your specific IT assets.

What an auditor asks for: The four core documents

If your organisation is audited for ISO 14001:2015, ISO 27001, or general UK GDPR compliance, the auditor will ask for a paper trail proving chain of custody. Here is exactly what those documents do and what they must contain.

1. Certificate of Data Destruction

• What it proves: That sensitive data was permanently eradicated prior to recycling or remarketing.

• Why you need it: UK GDPR compliance. This document is your legal defence against data breach liability and regulatory fines.

• What it must include: The method of destruction. This means naming the exact software used (such as Certus data erasure to NIST 800-88 standards) or the physical destruction standard (such as shredding to BS EN 15713:2023). It must also include the date of processing and the individual serial number of the wiped drive or device.

2. WEEE Waste Transfer Note (WTN)

• What it proves: The legal handover of physical electronic waste to an Environment Agency licensed carrier.

• Why you need it: To comply with the WEEE Regulations and environmental law. It proves you did not illegally dump commercial waste.

• What it must include: The correct EWC (European Waste Catalogue) codes, the total weight or quantity of the load, the collection address, and signatures from both your organisation and the waste carrier.

3. Itemised Asset Register

• What it proves: Exactly which devices left your facility.

• Why you need it: It connects your internal IT inventory to the waste transfer and data destruction certificates. Without it, you cannot prove a specific device was on the van.

• What it must include: The make, model, and chassis serial number of every individual device collected.

4. Hazardous Waste Consignment Note (HWCN)

• What it proves: The safe, legal transport and processing of dangerous environmental components.

• Why you need it: Hazardous Waste Regulations. Required when moving items like UPS battery backups, CRT monitors, or damaged lithium-ion batteries.

• What it must include: Specific hazard codes, UN numbers for transport (ADR compliance), and tracking details submitted to the Environment Agency.

Frequently Asked Questions

What paperwork do I need to prove GDPR compliance when scrapping business laptops in Great Britain?

To prove GDPR compliance for laptops, you must have an Itemised Asset Register listing the chassis serial numbers. You also need a Certificate of Data Destruction listing the individual serial numbers of the internal hard drives. Finally, you need a standard WEEE Waste Transfer Note to cover the physical chassis.

Do I need a data destruction certificate for a computer monitor?

No. Standard computer monitors do not contain data storage. You only need a WEEE Waste Transfer Note for monitors. However, if the screen is an “All-in-One” PC (like an Apple iMac), it contains an internal hard drive. That requires a Certificate of Data Destruction.

How long do I legally need to keep IT disposal certificates?

By law, you must keep WEEE Waste Transfer Notes for two years from the date of transfer. You must keep Hazardous Waste Consignment Notes for three years. Certificates of Data Destruction should be kept indefinitely, or in line with your organisation’s internal data retention policy, to prove historical GDPR compliance.

Does a WEEE waste transfer note cover data destruction?

No. A Waste Transfer Note only proves that you legally transferred the physical hardware to a licensed facility. It makes no guarantees about the data on the devices. You must always obtain a separate Certificate of Data Destruction for data-bearing items.

What happens if a disposal company does not provide an itemised asset register?

If you do not receive an itemised register listing individual serial numbers, you cannot prove to an auditor that a specific laptop or server was actually destroyed. A WEEE certificate that simply says “50 laptops collected” is not sufficient for GDPR audits.

Who is legally responsible for signing the waste transfer note?

Both parties must sign it. A representative from your organisation (the waste producer) must sign to confirm the description of the assets is accurate. The licensed waste carrier must sign to confirm they have taken possession of the load.

What document do I need if I am disposing of a server rack with UPS batteries?

You will need a Hazardous Waste Consignment Note for the UPS batteries. You need a standard WEEE Waste Transfer Note for the metal rack and cabling. You will also need Certificates of Data Destruction for any servers, switches, or drives left inside the rack.

Where do I find the correct EWC code for my IT disposal documents?

EWC codes categorise the exact type of waste you are moving. Most standard IT equipment falls under a few specific codes. We maintain a quick-reference guide to EWC waste codes for IT assets to help you find exactly what you need.

How Surplex UK Limited handles disposal documents

Surplex UK Limited provides all required compliance documentation—including WEEE Waste Transfer Notes, Hazardous Waste Consignment Notes, Itemised Asset Registers, and Certus Certificates of Data Destruction. We deliver these directly through our free IT asset tracking software portal. Through our value-offset commercial model, the resale value of your redundant hardware can offset the entire cost of collection, certified destruction, and reporting.