For UK businesses trying to distinguish a genuinely competent ITAD provider from one that simply claims to be, ADISA certification has become one of the most widely recognised reference points in the industry. Understanding what the certification actually assesses is useful whether or not a specific provider holds it — it tells you what questions are worth asking.

ADISA, the Asset Disposal and Information Security Alliance, operates a certification programme specifically focused on IT asset disposition, assessing providers against detailed operational standards covering data sanitisation processes, physical and information security controls, chain of custody procedures, staff vetting, and environmental compliance. Unlike a generic quality accreditation applied loosely across many industries, ADISA’s standard was built specifically around the risks unique to IT asset disposal, which is what makes it a useful reference point when evaluating a provider for this specific purpose.

Certification is not granted on the basis of a policy document review alone. ADISA conducts audits that include unannounced site visits, meaning a certified provider has demonstrated their processes are followed consistently in practice, not just documented on paper for the benefit of an inspection they knew was coming.

The standard also incorporates a risk-based classification system, recognising that different types of data carry different levels of sensitivity and require correspondingly different handling — directly relevant for organisations in regulated sectors such as finance, healthcare, and the public sector, where the consequences of a data handling failure are more severe.

The genuinely useful takeaway for any business evaluating a provider is not simply “do they hold ADISA,” but what the underlying assessment actually covers — data sanitisation methodology, physical and information security controls, staff vetting, chain of custody, and environmental compliance. A provider without formal ADISA certification can still meet, and evidence, every one of those individual elements directly, and it is entirely reasonable to ask them to.

For transparency: we are not currently ADISA certified. What we do have in place is a registered waste carrier licence, an Environment Agency permit covering our processing activities, Cyber Essentials certification, vetted staff, GPS-tracked collection vehicles, and a data sanitisation process built around NIST 800-88 principles, carried out on Certus erasure software by certified erasure technicians. We’ve set out what ADISA covers here because it’s a genuinely good checklist for assessing any provider, ourselves included — and we’re happy to be asked how we stack up against each element directly.