ITAD in the United Kingdom: Regulations and Compliance Guide

Key UK Regulations for Mobile ITAD

Waste Electrical and Electronic Equipment Regulations 2013 (SI 2013/3113)

The WEEE Regulations 2013 implement the EU WEEE Directive in the UK and establish obligations for producers (including importers), distributors, and treatment facilities dealing with electrical and electronic equipment at end of life. The regulations were retained and updated post-Brexit — they apply in England, Scotland, and Wales. Northern Ireland retains alignment with EU WEEE requirements under the Windsor Framework.

For mobile ITAD operators in the UK, the key obligations are:

• Devices that cannot be resold must be sent to an Approved Authorised Treatment Facility (AATF) — not general waste
• If you collect WEEE from businesses as part of an ITAD contract, you must comply with the relevant duty of care under the WEEE Regulations
• Treatment facilities must register with the Environment Agency (or SEPA in Scotland) as an AATF

UK GDPR and Data Protection Act 2018

UK GDPR (retained from EU GDPR under the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018 establish the legal framework for personal data protection in the UK. The key obligation for ITAD operators is Article 5(1)(f) of UK GDPR — the "integrity and confidentiality" principle — which requires that personal data be processed "in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage."

For devices you receive for ITAD processing, you are a "data processor" under UK GDPR. You need a written Data Processing Agreement (DPA) with your enterprise clients, and you must erase device data to a certified standard before resale. The ICO provides guidance on data destruction in IT asset disposal.

Environment Agency Waste Handling

ITAD operators who collect, transport, or treat electrical waste must comply with the Environmental Permitting (England and Wales) Regulations 2016 as amended. Treatment activities require either an environmental permit as an AATF (for treatment facilities) or an exemption registration (for smaller-scale operators meeting specific criteria). Operators who collect WEEE from businesses for transport to a treatment facility need a waste carrier licence from the Environment Agency.

Certifications Available to UK ITAD Operators

• AATF (Approved Authorised Treatment Facility): Required for facilities treating WEEE. Registered with the Environment Agency.
• BS EN 15713:2009: British Standard for the secure destruction of confidential material, applicable to data destruction services.
• ISO 27001: Information security management system standard. Enterprise clients in financial services and healthcare often require this from ITAD vendors.
• Cyber Essentials: NCSC-backed certification covering basic cybersecurity hygiene. Relevant for ITAD operators handling client data.

Practical Compliance Steps for UK Mobile ITAD Operators

1. Register as a waste carrier with the Environment Agency if you will be collecting WEEE from client sites
2. Establish a relationship with an AATF for disposal of non-resalable devices
3. Implement a certified data erasure process with per-device certificate generation
4. Put a Data Processing Agreement in place with each enterprise ITAD client
5. Maintain records of waste transfers (consignment notes) for audit
6. Ensure professional indemnity insurance covers data breach risk

ITAD Market in the UK

The UK mobile ITAD market is supported by strong WEEE infrastructure, CheckMEND IMEI checking services (covering stolen-device and finance checks), and a mature secondary market for refurbished smartphones. UK operators benefit from the established regulatory framework — compliance is documented and understood — which makes the compliance investment more predictable than in markets where regulations are newer.

For the full guide to starting a buyback or ITAD business in the UK, see the UK buyback business guide.