The Seven Documents Your Company Should Receive When It Sells Its IT Equipment

A company that sells its old laptops and servers usually thinks about the price and the data. It rarely thinks about the paperwork until an auditor, an insurer or the Environment Agency asks for it. This is the short list of documents a UK business should receive when it disposes of IT equipment, why each one exists, and what to do if a buyer cannot provide it.

1. A signed collection manifest

What it is: a list of everything handed over — make, model, serial number, quantity — signed by your representative and the collector’s driver at the moment of handover.

Why it matters: it is the point at which responsibility transfers. If a device later turns up somewhere it should not, the manifest establishes whether it was ever in the buyer’s hands. It is also the document against which every subsequent certificate is reconciled. Without it, a certificate for “drive serial ABC123” cannot be tied back to a machine that was yours.

What good looks like: serial numbers, not just counts. Signed before anything is loaded, with a copy left with you.

2. A seller’s declaration

What it is: a one-page statement, signed by you, confirming that the company owns the equipment outright, that nothing is on lease or finance, that devices have been removed from your management systems (Intune, Autopilot, Apple Business Manager, Find My), and that no BIOS or firmware passwords remain.

Why it matters: it protects both sides. A leased laptop sold by mistake is a problem for you as much as the buyer. A device still in your Microsoft tenant will re-enrol itself on the next owner’s desk with your company login screen. The declaration makes those checks part of the process rather than an assumption. Reputable buyers ask for it; be cautious of one who does not.

3. A data destruction authorisation

What it is: your written instruction to the buyer on what to do with the data on each class of device — erase to a named standard, physically destroy, or a mixture.

Why it matters: under UK GDPR the buyer is processing your data on your instructions, and those instructions should be written. It also stops arguments later: a drive you asked to be shredded cannot be resold, and a drive you asked to be erased and reused should not be shredded and charged for. If your organisation has a policy that says “destroy”, this is where it is recorded.

4. Erasure certificates, one per drive

What it is: a certificate for each storage device, by its own serial number, stating the standard met (normally NIST SP 800-88 or IEEE 2883), the method, the verification result and the date. We have written a separate guide to what an erasure certificate should contain.

Why it matters: it is the evidence that the personal data on your old machines is gone. It is what you produce if anyone ever asks.

5. A serialised asset register

What it is: the buyer’s record of everything received, by serial number, with its disposition — refurbished, sold for parts, recycled — and the certificate reference for each.

Why it matters: it closes the loop. Manifest says what left; register says what arrived and what happened to it. For anything you had on your fixed asset register, this is what your accountant needs to write it off.

6. A Waste Transfer Note

What it is: a legal document required under the Environmental Protection Act whenever waste passes from one party to another. Electrical equipment that is being recycled rather than reused is waste; equipment going for resale generally is not. The note records what was transferred, who transferred it, who received it, and the receiver’s Environment Agency waste carrier registration number.

Why it matters: a business has a legal duty of care for its waste and must use a registered carrier. If a buyer collects your old kit and fly-tips the worthless parts, and you have no Waste Transfer Note naming a registered carrier, the liability can come back to you. Any legitimate buyer of used IT will hold an upper-tier carrier registration — it is a “CBDU” number, and you can check it in seconds on the Environment Agency’s public register. Ours is CBDU584637; we put it on every note and invite sellers to check it.

What good looks like: the carrier number and, separately, the receiving site’s permit or exemption number. They are different registrations; a buyer who quotes one in place of the other has not understood their own paperwork.

7. A data processing agreement (if you need one)

What it is: a contract under UK GDPR Article 28 setting out the buyer’s obligations as a processor of your data: what they may do with it, security measures, confidentiality, what happens on completion.

Why it matters: Article 28 requires it whenever a processor handles personal data on your behalf. For a small company selling a few laptops with no sensitive data, many organisations treat the destruction authorisation and certificates as sufficient. For anyone regulated — healthcare, legal, financial, education, public sector — it should be in place before collection. Ask for it; a buyer who does not have a template has not dealt with regulated customers.

What you can safely not worry about

Accreditation logos are not a substitute for the documents above. ADISA is the UK scheme that matters for IT disposal, and holding it is a genuine mark of process quality, but a buyer without ADISA who supplies all seven documents is in better shape than one with a logo and a single-page “certificate of disposal”. We do not hold ADISA and we say so; what we do supply is everything on this list.

A quick checklist

• Manifest signed before loading, serial numbers included, copy left with you
• Seller’s declaration signed — title, no lease, management removed, no BIOS passwords
• Data destruction instruction in writing
• Erasure certificate per drive, by drive serial
• Asset register with disposition per device
• Waste Transfer Note with a checkable CBDU carrier number
• Article 28 agreement if you handle regulated or sensitive data

All seven are standard on our collections, at no charge, and we are happy to send blank samples before you commit to anything. Email info@hgctechnologies.uk or WhatsApp us on 0800 208 8010. How we buy, erase and pay is set out on our IT buyback page.