ITAD Procurement Tools & Templates

Yes. The procurement checklist is designed to be usable for NHS, council, and university procurement. The compliance language in it reflects UK GDPR, WEEE Regulations 2013, and common public sector certification requirements. You'll need to adapt the scope and quantities for your specific contract.

A chain of custody document records the transfer of IT assets from your organisation to the ITAD supplier. While not explicitly required by a single piece of legislation, it is considered best practice under UK GDPR accountability requirements (Article 5(2)) and is typically required as part of an NHS or council ITAD contract. Without it, proving compliant disposal in an audit is significantly harder.

For data-bearing assets, ADISA certification is the most relevant — it specifically audits the data security aspects of IT disposal. ISO 27001 is important for overall information security management. WEEE ATF registration is a baseline statutory requirement. BS EN 15713 is relevant if physical destruction of media is part of the scope. For most NHS or council contracts, a supplier holding ADISA, ISO 27001, and WEEE ATF registration will meet the minimum qualification criteria.

A valid certificate of data destruction should include: date of destruction, list of assets with serial numbers, destruction method (software overwrite to NIST 800-88 or physical shredding), the name and signature of the authorised operative, the company name and registration, and the client reference. For NHS contracts, the certificate should also reference the overwrite standard and whether any assets were found non-destructible and how they were handled.

Currently the tools are available as plain .txt files, which can be opened in any text editor, Word, or Google Docs and reformatted to your organisation's template. The plain text format is intentionally unformatted so it can be copied directly into your own documentation without style conflicts. Formatted PDF and Excel versions are planned.