The short answer:
Managing IT disposal in-house is legal and possible, but only if your organisation holds a valid Waste Carrier registration, can produce auditable chain-of-custody documentation, and has access to certified data destruction equipment. Most UK organisations do not meet all three conditions. For estates above 5 devices, or any assets containing sensitive data, outsourced ITAD almost always provides lower compliance risk and lower true total cost than internal handling — once internal resource time is counted.
This comparison follows our published review methodology. We are an ITAD provider, so we have a commercial interest in the outsourced outcome. We include honest cases where in-house management is the right answer.
Page details
Last reviewed: 20 April 2026
Methodology: 7-step framework
Bias disclosure: TFix provides outsourced ITAD. We do not assist with in-house disposal setups.
Jump to ScoresMost organisations discover these requirements after the fact — which is when compliance exposure becomes real.
Transporting WEEE waste without an Environment Agency Waste Carrier registration is illegal. This applies even for a single van trip to a recycling facility.
You must produce a Waste Transfer Note for every disposal consignment. These must be retained for at least 2 years under UK waste regulations.
GDPR requires auditable proof of data destruction. This means certified erasure software (not a format or factory reset) or physical shredding — both generating per-device serialised certificates.
You need a documented chain of custody from device collection to final disposal. Without this, you cannot demonstrate GDPR compliance in the event of an incident or audit.
Scores are 1 (poor fit) to 5 (strong fit) for a UK organisation with 10–500 devices, GDPR obligations, and an audit documentation requirement.
| Criterion | In-House Disposal | Outsourced ITAD |
|---|---|---|
| Security Assurance | 2/5 Depends entirely on internal capability. Factory reset ≠ certified destruction. | 5/5 Serialised per-device certificates from certified equipment and licensed facility. |
| Regulatory Compliance | 2/5 Most organisations lack Waste Carrier registration, certified destruction, and WTN process. | 5/5 Waste Carrier licence, WEEE compliance, GDPR-certified destruction — provided as standard. |
| Logistics Complexity | 2/5 Internal staff must handle disconnection, packing, transport, and documentation. | 5/5 Specialist team manages site survey, removal, packing, GPS-tracked transport, and disposal. |
| Speed & Scheduling | 3/5 Flexible if internal resource is available; often delayed by competing priorities. | 4/5 Fixed booking and confirmed project timeline. Can accommodate lease-end or move deadlines. |
| Documentation Outputs | 1/5 Rarely produces audit-grade outputs without specialist tools. High ICO incident risk. | 5/5 WTN, Certificates of Destruction, WEEE consignment notes, photographic asset logs. |
| Commercial Fit | 3/5 Appears low cost until staff time, licensing, and liability exposure are counted. | 4/5 Predictable fee. Asset recovery offsets often reduce or eliminate net cost. |
We include this section because our methodology requires it. There are situations where in-house disposal is legitimate and proportionate:
Only if you hold a valid Environment Agency Waste Carrier registration. Transporting WEEE waste without registration is unlawful — this includes a single trip to a recycling facility in a company van.
The originating organisation retains GDPR liability as the data controller, regardless of who physically handled the equipment. Documented chain of custody and certified destruction certificates significantly reduce your audit and ICO incident exposure.
No. Factory resets and disk formats do not meet the GDPR standard for data destruction. Data can be recovered from formatted drives. Compliant destruction requires certified overwrite to NIST 800-88 standard or physical shredding — with a certificate to prove it.
Viable assets entering the refurbished IT market generate resale revenue that can reduce or eliminate the net cost of ITAD. On a typical mixed office refresh (100–200 devices with laptops under 5 years old), recovery offsets of 30–70% of the service fee are achievable. Older or specialist enterprise hardware offsets vary.
We manage every step: site survey, hardware disconnection and packing, GPS-tracked collection, certified data destruction, WEEE-compliant recycling, and asset recovery with value reporting. All documentation is provided as standard — WTNs, Certificates of Destruction, WEEE consignment notes, and photographic asset logs.
Related decision pages