How to Choose an ITAD Vendor in Canada: Selection Checklist and RFP Questions

Choosing an IT asset disposition (ITAD) vendor is a risk decision disguised as a procurement decision. The pricing sheets look similar. The certification logos look similar. The difference between a good outcome and a data breach with your name on it is usually buried in details that never appear in a proposal.

Most ITAD selection guides are written for a US market and skip the parts that matter in Canada: provincial stewardship obligations, privacy law that varies by province, and one certification question that almost nobody asks. This checklist covers the criteria that matter, the questions to put in your RFP, and how to verify the answers rather than take them on trust.

Start With the Certification Question Nobody Asks

Here is the single most useful question you can put to an ITAD vendor:

“Which of your facilities will process our assets, and which certifications are held at that specific facility?”

Certifications are issued to facilities, not to companies. A vendor operating five sites may hold NAID AAA at one of them and not the others. They can accurately describe themselves as NAID AAA certified in marketing material while the site that actually receives your hard drives holds no such certification.

This is not a hypothetical gap. Our own certifications are a case in point: eCycle holds R2, ISO 9001, ISO 14001, and ISO 45001 across our facilities, while NAID AAA and ISO/IEC 27001 are held at our Brampton facility specifically. We publish that breakdown on our certifications page because a buyer needs to know which site handles their material.

Ask for the certificate itself, with the facility address and expiry date on it, and check the number against the issuing body’s public registry. A logo on a website is not verification. Our guide to spotting unreliable e-waste recyclers covers the other common misrepresentations.

The Five Criteria That Actually Separate Vendors

Once certification is verified at the facility level, five areas do most of the discriminating.

1. Chain of custody

You need documented custody from the moment assets leave your loading dock to the moment they are destroyed or resold. That means serialized asset tracking, signed transfer at every handoff, and reporting that reconciles what left your site against what was processed.

The failure mode to probe for is subcontracting. Ask directly whether any part of transport, storage, or processing is handled by a third party, and if so, what certifications that party holds. A clean chain of custody through your vendor means nothing if there is an uncertified link in the middle.

2. Data security and destruction method

Ask what destruction method is used for each media type, whether it happens on-site or off-site, and what documentation you receive. You want a certificate of destruction that lists serial numbers, not a generic letter confirming a pallet was processed. Our post on why secure data destruction matters covers the risk side in more detail.

3. Value recovery

Retired equipment often has residual value, and a good ITAD partner should be able to tell you what and how. Ask how resale value is assessed, what the revenue share arrangement is, and whether you receive settlement reporting tied to specific assets. Resale and remarketing done properly can offset a meaningful share of the programme cost.

Be wary of a vendor who quotes an attractive rebate without explaining how it is calculated.

4. Environmental responsibility and downstream transparency

Reuse before recycling is the standard a responsible vendor should be working to. Beyond that, ask where material goes after it leaves them. Downstream vendor lists, landfill diversion figures, and export policy are all fair questions, and a vendor who cannot answer them clearly is telling you something.

5. Reporting

You should be receiving asset-level reporting, environmental impact reporting for your sustainability disclosures, and certificates of destruction, all on a predictable schedule. Ask to see a sample report during the RFP rather than after you have signed.

What Canadian Buyers Need That US Checklists Skip Three things.

Privacy law is not uniform. PIPEDA applies federally, Quebec’s Law 25 imposes its own obligations, and some provinces have their own private-sector privacy statutes. If you operate across provinces, your ITAD process has to satisfy the strictest applicable regime, not the average one. Confirm your vendor understands which applies to you.

Provincial stewardship programs differ. Electronics recycling in Canada runs through provincial programs with different rules and different registered participants. A vendor operating nationally should be able to explain their participation province by province. Our stewardship programs page sets out where we participate.

Cross-border movement adds obligations. If assets cross into the US or offshore, that introduces export requirements. Ask whether it happens and under what controls.

Insurance and Where Liability Actually Sits

This is the criterion buyers most often skip, and it becomes the only one that matters if something goes wrong.

Ask for a certificate of insurance and read the limits. General liability is standard. What you specifically want to confirm is whether coverage extends to data breach and professional liability, because a general liability policy will not respond to a privacy incident arising from improperly destroyed media. Confirm the limits are proportionate to the volume and sensitivity of what you are handing over.

Then read the contract for the liability cap. Many ITAD agreements cap the vendor’s liability at the value of the services performed. If you are paying a few thousand dollars to dispose of drives holding customer records, a cap at contract value transfers essentially all of the breach exposure back to you. That may be acceptable, but it should be a decision rather than a surprise.

Ask who indemnifies whom, and for what. A vendor confident in their process will negotiate on this. A vendor who will not discuss it at all is telling you where they think the risk lives.

Red Flags Worth Walking Away From

Some signals are strong enough to end a conversation early.

A vendor who cannot name the specific facility that will process your assets is either disorganized or subcontracting without saying so. Either is disqualifying for sensitive material.

A refusal to provide sample documentation, whether a certificate of destruction, a chain of custody record, or an environmental report, generally means the documentation does not exist in the form described. Sample documents cost a vendor nothing to share.

Certifications that cannot be verified in a public registry, or that turn out to be expired, held by a related entity, or held at a different site, are a straightforward misrepresentation.

Reluctance to disclose downstream partners is common and it is worth pushing on. Responsible processors know where their material goes and are willing to say. Vague answers about “certified downstream partners” without names generally mean the chain is not traced past the first handoff.

Finally, be cautious about a rebate that materially exceeds what other bidders offer for the same inventory. Value recovery is a fairly efficient market. A number well outside the range usually reflects either an optimistic assumption that will be revised after collection, or cost recovered somewhere less visible.

The RFP Question Set

Put these in writing and require written answers.

 
If you want a shorter starting point before running a full process, our five questions to ask before partnering with an ITAD provider covers the essentials.

Frequently Asked Questions

 
If you are building an ITAD programme or reviewing an incumbent, our IT asset disposition team is happy to work through the checklist with you. Request a quote or call 888.945.2611.