From CSR to Compliance: Why Corporate E-Waste Donation Programmes Now Need a Rule-Book

Updated: September 28, 2026 · 15 min read

When the Ministry of Environment, Forest and Climate Change (MoEFCC) notified the E-Waste (Management) Rules, 2022 in November of that year, most corporate CSR teams treated the change as a producer-side problem. Donation programmes — laptops to schools, desktops to NGOs — continued exactly as before: a lorry, a handover letter, and a photo for the annual report. By FY 2026–27, that reading is demonstrably wrong, and the regulatory exposure it creates sits squarely at the intersection of environmental law, data-protection liability, and SEBI’s BRSR disclosure framework. This piece sets out precisely what the rules require, where donation programmes fall short, and what a defensible corporate e-waste donation programme looks like in practice.

The Good-Faith Assumption That Is Now a Liability

The logic behind corporate e-waste donation has always been appealing: a device that still functions is better donated than dismantled, waste is reduced, digital access is extended, and a CSR checkbox is ticked. None of that logic is wrong in principle. The problem is that Indian environmental law does not recognise good faith as a compliance defence once a regulated waste stream leaves a controlled chain of custody.

End-of-life electronic equipment is a scheduled waste under the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016. The moment a corporate entity — an IT company in Bengaluru, a bank in Mumbai, a manufacturer in Pune — transfers a device to an entity that is not registered under the E-Waste (Management) Rules, 2022, it creates a gap in the regulatory chain. Whether the receiving entity is a school, a charitable trust, or an informal reseller, the obligation on the original holder does not disappear at the point of handover. It remains with whoever generated the waste until it can demonstrate lawful disposal or refurbishment through an authorised channel.

This is not a theoretical risk. India generated an estimated 1.6 million metric tonnes of e-waste in 2023–24, according to data cited by the Central Pollution Control Board (CPCB). Of that, formal recycling captured less than 40% — a figure that has prompted significantly sharper enforcement posture from both CPCB and State Pollution Control Boards, particularly the Maharashtra Pollution Control Board (MPCB), over the past 18 months.

What E-Waste (Management) Rules, 2022 Actually Say About Channelisation

The E-Waste (Management) Rules, 2022 impose obligations across the entire value chain — producers, manufacturers, dealers, refurbishers, dismantlers, and recyclers. Rule 5 places Extended Producer Responsibility (EPR) obligations on producers, requiring them to ensure collection of end-of-life equipment and its channelisation to registered dismantlers or recyclers. Rule 16 deals with bulk consumers — corporates, government bodies, and institutions that use electrical and electronic equipment in bulk — and requires them to ensure their e-waste is deposited with an authorised collection centre, dealer, refurbisher, dismantler, or recycler.

The phrase “authorised” is the operative word. An NGO that receives donated laptops and re-distributes them, unless it holds a refurbisher registration under the Rules, is not an authorised entity in the regulatory sense. When those devices eventually reach end of life — which they will, typically within 2–3 years of donation — they are overwhelmingly likely to enter the informal dismantling sector, precisely the outcome the Rules are designed to prevent.

What “Refurbisher” Registration Actually Requires

Under Rule 2(1)(zj) of the E-Waste (Management) Rules, 2022, a refurbisher is an entity that repairs or restores used electrical and electronic equipment and must be registered with the relevant State Pollution Control Board. Registration requires a physical facility inspection, a documented process for handling components that cannot be refurbished, and a tie-up with a registered dismantler or recycler for residual waste. Very few of the NGOs and charitable bodies that receive corporate donations hold this registration. Corporates rarely ask.

₹250 Crore: Why DPDPA Section 33 Should Be on Every CIO’s Radar

Environmental compliance is only one dimension of the risk. The Digital Personal Data Protection Act, 2023 (DPDPA), administered by MeitY, introduced a framework that has direct consequences for any organisation transferring hardware that may carry residual personal data. Under the DPDPA, a corporate entity is a “data fiduciary” with respect to the personal data it processes. That fiduciary duty does not end when the device is handed over — it ends only when the data is verifiably destroyed.

Section 33 of the DPDPA empowers the Data Protection Board to impose financial penalties of up to ₹250 crore for significant breaches of data security obligations, including failure to implement adequate security safeguards. A donated laptop with employee records, customer data, or financial information in an unwiped state is precisely the kind of breach the Board is designed to act on. The Act does not carve out an exemption for charitable intent.

The Data Sanitisation Gap in Typical Donation Programmes

In practice, device sanitisation in corporate donation programmes is inconsistently applied. A 2025 industry survey cited in press reports covering Indian IT asset disposition found that fewer than one in three corporates could produce a certified data-destruction record for donated devices — a gap that is simultaneously a DPDPA liability and an audit finding under BRSR Core disclosures. BRSR Core, mandated by SEBI’s circular dated 12 July 2023 for the top 150 listed entities by market capitalisation, requires disclosure of environmental and governance practices in a manner that is independently verified. An undocumented donation route fails both the “governance practice” standard and the audit trail requirement.

The standard for data destruction is not a factory reset. ISO/IEC 27001 and the NIST SP 800-88 guidelines — increasingly referenced by MeitY in its advisories — require either physical destruction, degaussing, or certified overwrite processes. A certificate from an accredited data-destruction vendor or an authorised recycler is the minimum document a DPDPA-compliant organisation should hold for every donated or disposed device.

EPR Targets, Authorised Recyclers, and Why Informal Donation Routes Don’t Count

Under the E-Waste (Management) Rules, 2022, producers of electrical and electronic equipment are required to meet collection and channelisation targets, expressed as a percentage of the quantity of equipment placed on the market in prior years. For FY 2026–27, the EPR collection target for most categories of equipment stands at 70% of the weight placed on market in FY 2023–24. These targets are tracked through the CPCB’s e-waste EPR portal, and EPR credits are generated only when a registered recycler or dismantler uploads a recycling certificate matched to a producer’s registration.

This architecture has a direct implication for corporates operating as bulk consumers under Rule 16, particularly those who are also producers or whose group entities are producers. Devices channelled through an unregistered donation route generate no EPR credit. Worse, if the device eventually enters the informal sector, it may be counted as a recycling leak in CPCB’s annual compliance review — a reputational and regulatory problem for the producer entity in the same corporate group.

The solution is not to stop donating. It is to route donation through a structured corporate e-waste donation programme that pairs with a registered refurbisher for viable devices and a CPCB-authorised recycler for the remainder. That way, the donation achieves its social purpose and the chain of custody remains intact for every device in the lot.

The Enforcement Signal: What CPCB Actions in FY 2025–26 Tell Us

CPCB’s enforcement posture on e-waste has shifted materially since FY 2024–25. The Board has issued directions under Section 5 of the Environment Protection Act, 1986 to non-compliant producers and bulk consumers in multiple states, with particular focus on entities in Maharashtra, Karnataka, and Tamil Nadu — three states with the highest concentration of IT assets and the strongest SPCB capacity for inspection. While CPCB has not publicly named all subjects of enforcement actions (and we do not speculate on specific cases here), the pattern of directions published on the CPCB portal through Q1 FY 2026–27 points to three recurring non-compliance themes: absence of EPR registration, no documentation of bulk consumer channelisation, and use of unregistered dismantlers.

The penalties available are not trivial. Section 15 of the Environment Protection Act, 1986 provides for imprisonment up to five years or a fine up to ₹1 lakh per day of continuing violation, or both. For a corporate with a three-year history of undocumented donation, the cumulative exposure — if a regulator chose to pursue it — would be significant. More immediately, CPCB has the power to direct closure or restriction of operations under Section 5, a power that has been exercised in analogous contexts against plastic and hazardous waste violators.

The direction of travel is clear. With the NITI Aayog’s circular economy policy framework pushing for formalisation of the e-waste sector and with SEBI’s BRSR Core mandating third-party verification of sustainability disclosures, the window for treating e-waste donation as an informal CSR gesture is closing fast.

What a Defensible Corporate E-Waste Donation SOP Must Include

A Standard Operating Procedure for corporate e-waste donation that can survive a CPCB inspection, a DPDPA audit, or a BRSR third-party verification must address every stage from device retirement to final disposition. The following checklist covers the minimum required actions for FY 2026–27.

1. Asset Register Update: Log every device being considered for donation with its serial number, model, original purchase year, and current storage location. This feeds into your bulk consumer record-keeping obligation under E-Waste (Management) Rules, 2022, Rule 16(3).
2. Data Destruction Before Transfer: Commission certified data wiping (minimum DoD 5220.22-M three-pass standard) or physical destruction of storage media for every device. Obtain a certificate from the vendor with device serial number and destruction method. Retain for a minimum of two years — the CPCB-mandated record retention period under the Rules.
3. Verify Recipient Registration: Confirm that the receiving NGO, school, or trust holds a valid refurbisher registration under the E-Waste (Management) Rules, 2022 from the relevant State Pollution Control Board. Request a copy of the registration certificate and retain it on file.
4. Pair With an Authorised Recycler for Residual Devices: Devices that fail the donation triage (damaged screens, dead batteries, obsolete hardware) must go to a registered dismantler or recycler. Do not allow these to be informally discarded or sold to a scrap dealer who is not registered. See our CPCB-authorised e-waste recycling service for a compliant channel.
5. Issue a Chain-of-Custody Document: Prepare a transfer manifest for every batch — date of transfer, quantity of devices, receiving entity name and registration number, data destruction certificate reference, and name of the authorised recycler handling residual items. This is your primary evidence document if questioned.
6. Obtain a Recycling Certificate for Residual Items: The authorised recycler must issue a recycling certificate (or certificate of destruction) for every device that is recycled rather than donated. This document is required for EPR credit reconciliation and for BRSR Core disclosures.
7. Record in BRSR E-Waste Disclosure: Under SEBI’s BRSR Core framework (circular dated 12 July 2023), listed entities must disclose e-waste generated and disposed of in metric tonnes, with the disposal method specified. Ensure your donation and recycling records are aggregated in a format your sustainability auditor can verify independently.
8. Annual Compliance Review: Conduct an internal audit of the SOP at the start of each financial year — Q1 FY 2027–28 at the latest — against any amendments to the E-Waste Rules or DPDPA implementation rules notified by MeitY and MoEFCC during the year.

Comparing Donation Channels: Authorised vs. Informal Routes

The table below summarises the key differences between a compliant, structured corporate e-waste donation programme and the informal donation route that most CSR teams currently operate. The cost differential is smaller than most procurement heads assume — the compliance differential is not.

Parameter	Informal Donation Route	Compliant Structured Programme
Recipient registration check	Rarely done	Mandatory; SPCB refurbisher registration verified
Data destruction	Factory reset or none; no certificate	Certified wipe/destroy; serial-number-level certificate
Residual device handling	Informal scrap dealer or landfill	Authorised dismantler/recycler; recycling certificate issued
EPR credit generated	None	Yes, via registered recycler portal upload
DPDPA exposure	High; no certified destruction proof	Low; certified destruction certificate on file
BRSR Core disclosure-ready	No; no auditable data trail	Yes; chain-of-custody records in metric tonnes
Environment Protection Act, 1986 penalty exposure	Up to ₹1 lakh/day per violation	Negligible; full documentation in place
Typical additional cost vs. informal route	Nil upfront; high tail risk	₹80–₹200 per device for data destruction + logistics

Related Articles

• What an EPR Audit Looks Like in 2026: A Walk-Through With Document Checklist
• How Much Does EPR Actually Cost an Indian SME? A Real-Numbers Breakdown
• Why FMCG Brands Are Locking in 3-Year Recycler Contracts in 2026 (And You Should Too)

Frequently Asked Questions

Does donating laptops to an NGO count as compliant e-waste disposal under E-Waste Rules 2022?

Only if the NGO holds a valid refurbisher registration under the E-Waste (Management) Rules, 2022, issued by the relevant State Pollution Control Board. An unregistered recipient — however well-intentioned — does not satisfy the channelisation requirement under Rule 16 for bulk consumers. When those devices eventually fail, they will almost certainly enter the informal sector, creating a downstream compliance gap traceable to the original donor organisation.

What is the penalty for a corporate that donates e-waste without following the Rules?

Section 15 of the Environment Protection Act, 1986 — which backstops the E-Waste (Management) Rules, 2022 — provides for a fine of up to ₹1 lakh per day of continuing violation, imprisonment up to five years, or both. CPCB also has the power under Section 5 of the Act to issue directions restricting or closing operations. These penalties apply regardless of the charitable intent behind the transfer.

Does DPDPA apply to employee laptops donated to schools?

Yes. Under the Digital Personal Data Protection Act, 2023 (DPDPA), a corporate entity is a “data fiduciary” responsible for all personal data it holds, including residual data on end-of-life hardware. A device transferred without certified data destruction can expose the fiduciary to penalties up to ₹250 crore under Section 33 of the DPDPA, administered by MeitY’s Data Protection Board. A factory reset does not constitute certified destruction under the Act’s security obligation framework.

How long must a company retain e-waste disposal records?

The E-Waste (Management) Rules, 2022 require bulk consumers to maintain records of e-waste generated and channelised for a minimum of two years, available for inspection by CPCB or the relevant State Pollution Control Board on demand. For BRSR Core disclosures under SEBI’s circular dated 12 July 2023, records must also be in a form that can be independently verified by a third-party auditor, which in practice means device-level documentation, not just aggregate tonnage figures.

Can EPR credits be generated through a corporate donation programme?

EPR credits under the E-Waste (Management) Rules, 2022 are generated only when a registered recycler or dismantler uploads a recycling certificate to the CPCB e-waste EPR portal against a producer’s registration. Donation to an unregistered recipient generates no credits. A structured donation programme that routes residual devices through a registered recycler — and obtains recycling certificates — can generate partial EPR credits for the non-donatable portion of the lot, improving the producer’s EPR compliance position for FY 2026–27.

Work With The National Recycling Corporation

The National Recycling Corporation operates a pan-India corporate e-waste donation programme that is built around regulatory compliance, not just logistics. We handle the full cycle: pre-donation triage, certified data destruction with serial-number-level certificates, transfer to verified refurbishers for viable devices, and authorised recycling with recycling certificates for the remainder. Every engagement produces a chain-of-custody document pack that your legal, compliance, and sustainability teams can rely on — whether for a CPCB inspection, a BRSR audit, or a DPDPA due-diligence review.

Our disposal partners hold CPCB authorisation and State Pollution Control Board registrations across Maharashtra, Karnataka, Tamil Nadu, Delhi-NCR, Gujarat, and Telangana. All invoicing is GST-compliant. Where devices carry recoverable value — copper, aluminium, or precious metals from circuit boards — we provide fair-market pricing indexed to prevailing LME rates, which in Q2 FY 2026–27 have kept copper recoveries between ₹680 and ₹720 per kg. That recovered value can offset a material portion of your programme’s data-destruction and logistics costs.

Our documentation package is BRSR Core-grade as standard: tonnage by device category, disposal method, recycler registration numbers, and recycling certificates, all formatted for direct insertion into your annual sustainability report. We also provide a single-point EPR compliance advisory for bulk consumers who need to reconcile their channelisation records with CPCB’s EPR portal. To discuss your organisation’s specific requirements, contact us or explore our broader EPR compliance services.

• Pan-India pickup with logistics documentation
• Certified data destruction to DoD and NIST standards, with per-device certificates
• Tie-up with CPCB-authorised dismantlers and recyclers
• Recycling certificates and chain-of-custody records for every batch
• GST-compliant invoicing for all transactions
• BRSR Core-formatted sustainability disclosure documentation
• Fair-market recovery pricing for metals, indexed to LME rates

Sources and References

• CPCB — E-Waste (Management) Rules, 2022 and EPR Portal
• Ministry of Environment, Forest and Climate Change — E-Waste Rules Gazette Notification, 2022
• CPCB — Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016
• Central Pollution Control Board — Annual E-Waste Management Reports
• NITI Aayog — Circular Economy Policy Framework
• London Metal Exchange — Copper and Aluminium Price References, Q2 FY 2026–27
• SEBI Circular dated 12 July 2023 — BRSR Core Framework for Third-Party Assurance (available on sebi.gov.in)
• Press reports (Economic Times, Mint) — Indian IT asset disposition survey data, 2025