In this article
- What is ITAD and why it matters in 2026
- Criterion 1: CPCB authorization and certifications
- Criterion 2: Data destruction standards
- Criterion 3: DPDP Act 2023 compliance readiness
- Criterion 4: Chain of custody and documentation
- Criterion 5: Transparency in value recovery
- Criterion 6: Scope of items accepted
- Criterion 7: On-site destruction capability
- Red flags that disqualify an ITAD vendor
- FAQ
What is ITAD and Why It Matters in 2026
IT Asset Disposition (ITAD) is the structured, compliant decommissioning of retired IT equipment — covering data destruction, asset recovery, recycling, and documentation. In 2026, ITAD is no longer optional for Indian organizations:
- The DPDP Act 2023 requires verifiable destruction of personal data on retired hardware.
- The E-Waste (Management) Rules 2022 mandate disposal through CPCB-authorized recyclers only.
- Corporate auditors and cybersecurity insurers now require Certificates of Data Destruction.
- Unregistered scrap dealers who buy your old servers, laptops and hard drives do not provide any of this documentation — exposing you to liability.
Warning: Handing IT assets to local kabadiwallahs or unregistered buyers is illegal under E-Waste Rules 2022 and creates an unacceptable data breach risk. The buyer has no obligation to destroy data and no authorization to recycle hazardous materials.
Criterion 1: CPCB Authorization and Certifications
The Central Pollution Control Board (CPCB) maintains a public list of authorized e-waste recyclers. Any legitimate ITAD provider must appear on this list and should be able to show you their authorization certificate with a valid expiry date.
Also look for: KSPCB registration (if operating in Kerala), ISO 14001:2015 (environmental management system), and ISO 9001:2015 (quality management).
Tip: Ask to see the actual certificate, not just a logo on the website. Check the certificate number against the CPCB registry if you handle large volumes.
Criterion 2: Data Destruction Standards
The answer tells you immediately whether a vendor is serious. A competent ITAD provider should be able to explain their methodology by media type:
| Storage Media | Recommended Method | Standard |
|---|---|---|
| HDD (reusable) | Software overwrite | NIST SP 800-88 Rev 1 (Clear/Purge) |
| SSD / NVMe | Cryptographic erasure + overwrite, or physical shredding | NIST SP 800-88 Rev 1 (Purge/Destroy) |
| Magnetic tape | Degaussing (20,000+ Oersteds) + physical destruction | NIST SP 800-88 / IEEE 2883-2022 |
| Classified/sensitive data | Physical shredding, DIN 66399 Level H-5 or H-6 | DoD / NSA standards |
| Non-functional drives | Physical drilling + shredding | NIST SP 800-88 Destroy |
A vendor who only says "we wipe the drives" without specifying the standard is a red flag.
Criterion 3: DPDP Act 2023 Compliance Readiness
India's Digital Personal Data Protection Act 2023 creates an obligation on data fiduciaries to ensure personal data is completely erased when no longer needed. For retired hardware this means:
- A serialized Certificate of Data Destruction for every device, identifying it by serial number or asset tag
- A chain-of-custody log from your premises to the recycling facility
- The vendor's own data processing agreement if they handle personal data during the process
Tip: Ask the vendor: "Can you provide device-level Certificates of Destruction listing serial numbers?" If the answer is no or they offer only a batch-level certificate, their documentation will not satisfy a DPDP audit.
Criterion 4: Chain of Custody and Traceability
Between your premises and the recycling facility, your assets must remain secure. Evaluate:
- Vehicle GPS tracking — can they show live or historical tracking of the collection vehicle?
- Background-checked staff — especially important for on-site data destruction
- Facility security — CCTV coverage, restricted access, visitor logs
- Asset inventory at pickup — do they inventory each device in your presence before leaving?
A collection that leaves your office without an inventory receipt creates an unacceptable audit gap.
Criterion 5: Transparency in Value Recovery
ITAD generates value through refurbishment, component harvesting, and material recovery. A legitimate provider shares this value with you. Red flags include:
- No upfront price estimate — they assess "after collection" and you have no leverage
- Cash-only payment with no receipt or GST invoice
- No weight certificates — you cannot verify the tonnage recycled
- Significantly lower prices than market rates without explanation
A good ITAD provider gives you a market-rate payment via bank transfer / UPI with a GST invoice, plus a weight/quantity certificate for your EPR reporting.
Criterion 6: Scope of Items Accepted
India's E-Waste Rules 2022 define 21 categories of e-waste. Your ITAD provider should accept all categories you generate — not just laptops and desktops. Common gaps include:
- UPS and inverter batteries (regulated under Battery Management Rules 2022)
- Servers and data center equipment
- Network switches, routers, and PBX systems
- Monitors, projectors, and displays
- Printers, MFDs, and scanners
- CCTV cameras and recording equipment
Fragmenting disposal across multiple vendors creates compliance gaps and complicates your EPR documentation.
Criterion 7: On-Site Destruction Capability
Banks, hospitals, defence contractors, and law firms often have policies prohibiting assets from leaving the premises before data destruction. For these cases, the ITAD provider must offer on-site mobile shredding — a mobile shredder arrives at your office and destroys drives in your presence.
Not every ITAD provider has this capability. If this is a requirement, confirm it upfront and ask for a demonstration or reference client.
Red Flags That Disqualify an ITAD Vendor
Walk away from any vendor who:
| Red Flag | Why It Matters |
|---|---|
| Cannot show CPCB authorization certificate | Disposal through them is illegal and creates your liability |
| Offers only cash payment, no GST invoice | Indicates undeclared recycling; no audit trail |
| Cannot specify data destruction standard used | Data may not actually be destroyed to any verifiable standard |
| Batch Certificates of Destruction (no serial numbers) | Cannot satisfy DPDP Act 2023 device-level audit requirements |
| No weight certificates for recycled material | Cannot support EPR compliance reporting |
| Significantly below-market pricing | Assets may be sold as-is with data intact, rather than recycled |
| No inventory taken at your premises during collection | No proof of what was collected; untraceable if something goes wrong |
Ewaste Kochi — ITAD Provider Checklist: All 7 Criteria Met
CPCB-authorized · NIST SP 800-88 certified destruction · Serialized Certificates · GST invoices · GPS-tracked vehicles · On-site shredding available · All 21 CPCB categories accepted