Certificate of Destruction vs Recycling Certificate.
Two documents that are often confused. One proves the data is gone; the other proves where the hardware went. Most audits need both.
A certificate of destruction proves that the data on specific, serial-numbered devices was wiped or physically destroyed. A Certificate of E-Waste Recycling proves that a quantity of e-waste went to an authorised recycler. The first answers “is the data gone?”; the second answers “where did the hardware go?”. A vendor who hands over only a recycling certificate has not proved anything about your data.
What each document proves.
| Certificate of destruction | Certificate of E-Waste Recycling | |
|---|---|---|
| What it proves | Data on named devices was wiped or destroyed | A quantity of e-waste was recycled through an authorised channel |
| Tied to | Individual serial numbers | Total weight or quantity for the job |
| Issued by | The company that did the wiping or destruction | The authorised recycler |
| Who asks for it | IT security, internal audit, ISO 27001 and client audits | EHS, sustainability and ESG or BRSR reporting |
| When PrivAce issues it | Same day onsite, within 2 working days offsite | Within 7 working days of pickup |
| Answers the question | “Is the data gone?” | “Where did the hardware go?” |
Where the manifest fits in.
There is a third document that sits between them: the Form 6 e-waste manifest, signed at your premises when the equipment leaves. It records the handover itself.
Put together, the three give an auditor a complete trail: what left the building and when (manifest), what happened to the data (destruction certificates or erasure reports), and where the material ended up (recycling certificate).
The common gap is a vendor that recycles properly but never touches the data, or one that wipes drives but cannot show where the rest of the equipment went. Ask for all three before you sign.
What a recycling certificate looks like.
Questions, answered.
No. It confirms that a quantity of e-waste went to an authorised recycler. It says nothing about the data on the drives. For that you need a certificate of destruction or erasure reports.
Evidence of secure disposal of equipment and deletion of information, which ISO/IEC 27001:2022 covers in controls 7.14 and 8.10. That means destruction certificates or erasure reports that tie back to your asset register.
The Certificate of E-Waste Recycling, because it records the quantity sent through an authorised channel. It supports the e-waste line in ESG and BRSR reporting.
Usually yes, plus the Form 6 manifest signed at pickup. Together they show what left, what happened to the data and where the material went.
Destruction certificates the same day for onsite work or within 2 working days for offsite work. The Certificate of E-Waste Recycling within 7 working days of pickup.
Last reviewed 30 September 2026. Sources: ISO/IEC 27001:2022, E-Waste (Management) Rules, 2022.
Want all three documents on your next job?
Every PrivAce job includes the manifest, destruction certificates and a recycling certificate.
