Certificate of Destruction for IT Assets: Complete UK Business Guide 2025

A single certificate can cover multiple devices, and this is standard practice. Your Certificate of Destruction will list all devices destroyed during a particular collection/destruction event, with each device identified by serial number. For example, if you dispose of 20 laptops, 5 servers, and 30 hard drives in one collection, you'll receive one certificate listing all 55 items individually.

Minimum retention period: 7 years (aligns with standard UK business record-keeping requirements). Best practice: Keep certificates indefinitely, especially for devices that stored special category personal data, legally privileged information, government classified data, or data subject to long-term regulatory retention. Store digital copies in secure, backed-up document management system and physical copies in fireproof safe or offsite storage.

Contact your ITAD provider immediately to request a duplicate. Reputable providers maintain records of all certificates issued and can reissue within 5-10 working days. When requesting a duplicate, provide original certificate number (if known), approximate date of collection/destruction, devices covered (serial numbers or general description), and business name and address. Duplicate certificates should be clearly marked 'DUPLICATE ISSUED [DATE]' to avoid confusion in your records.

A Certificate of Destruction is necessary but not sufficient for complete GDPR compliance documentation. You should maintain: (1) IT Asset Disposal Policy, (2) Device inventory, (3) Collection manifest, (4) Certificate of Destruction, (5) ITAD provider due diligence records, and (6) Incident logs. Think of the Certificate of Destruction as one piece of a comprehensive evidence package demonstrating your 'appropriate technical and organisational measures' under Article 5(2).

Yes, but with important caveats. If you're donating working devices to charity after data wiping, ensure the data wiping is performed by a certified ITAD provider or your own certified IT team, obtain a Certificate of Data Sanitisation, transfer devices to charity with written confirmation they understand devices contained business data that has been wiped, and retain copy of charity transfer documentation. Critical point: You remain liable under UK GDPR if data is recovered from donated devices. For highly sensitive data, physical destruction is safest, not donation.

Data Wiping: Software overwrites data multiple times using algorithms (NIST 800-88 methods). Data is unrecoverable; device remains functional for refurbishment/resale. Best for working devices and moderate sensitivity data. Physical Destruction: Mechanical destruction of device into particles typically <6mm. Data is unrecoverable because storage medium no longer exists. Best for damaged devices, highest sensitivity data, and devices that cannot be wiped. Many organisations use a hybrid approach: wiping for most devices, physical destruction for highest sensitivity equipment.

Free services typically include collection of working IT equipment in bulk (usually 10+ devices), data wiping to NIST 800-88 standards, WEEE-compliant recycling, and certificate within 10 working days. Free services are subsidised by the resale value of refurbished equipment. Chargeable services (typically £100-£500) include on-site shredding with immediate certification (£200-£400 per visit), small quantities (1-5 devices), physical destruction of all devices, older or damaged equipment, and expedited certification.

Your Certificates of Destruction remain valid even if the issuing provider ceases trading. The certificate evidences a specific destruction event that occurred on a specific date, certified by a qualified provider who held appropriate credentials at that time. Practical considerations: You won't be able to request duplicate certificates if you lose the original, so make backup copies (digital and physical) while provider is still operating.

Certificates of Destruction are primarily evidence for personal data protection obligations, but they're equally valuable for protecting trade secrets, commercially confidential information, intellectual property, and customer/supplier commercial data. Single certificate can cover mixed data types. You don't need separate certificates for devices storing personal data vs. business confidential data. The destruction method (wiping or shredding) is what matters, and that's determined by sensitivity level, not data category.

Technically yes, but practically not recommended for GDPR compliance evidence. The ICO expects independent verification from qualified third parties, certified processes (R2v3, e-Stewards, ISO 27001), and credible accountability. An internal certificate lacks independence. If you later face a data breach investigation, an ICO auditor will question the credibility of self-issued certificates. Most cost-effective approach: Let certified ITAD providers handle both wiping and certification. Your IT team's time is better spent on strategic work, and third-party certificates provide stronger legal evidence.