E-waste ITAD board in California: licenses, costs, and timelines

Last updated 2026-08-18

What is the e-waste ITAD regulatory board in California?

There is no single e-waste board in California. Oversight splits across two state agencies, and you need to understand both before you sign a lease or buy a shredder.

CalRecycle (the California Department of Resources Recycling and Recovery) runs the Electronic Waste Recycling Act program. That law lives at California Public Resources Code sections 42460 through 42491, and it created the Covered Electronic Waste (CEW) framework that funds collection and recycling through a fee paid at the register ^[1]. If you want to be paid as a recycler or collector under that program, CalRecycle registers you and audits you.

The California Department of Toxic Substances Control (DTSC) is the other agency you have to know. Any facility that stores, processes, or treats hazardous waste, which includes cathode ray tubes (CRTs) and certain circuit board materials, either needs a Hazardous Waste Facility Permit or operates under one of DTSC's tiered exemptions ^[2]. Most entry-level ITAD shops try to stay inside the Universal Waste Handler rules at 22 CCR 66273 rather than pull a full facility permit. That only works if you're not doing actual processing like smelting or shredding circuit boards on-site.

There is no third board. Some people bring up the Department of Industrial Relations because of worker safety rules around lead dust, and Cal/OSHA 8 CCR 5198 does apply to facilities where workers may touch lead-containing components ^[11]. But DIR is not a licensing authority for ITAD. It enforces. Know that difference before you build your compliance calendar.

Do you need a license for e-waste ITAD in California?

Yes, and the word "license" covers several separate pieces of paper, each from a different agency.

First: CalRecycle registration. The Electronic Waste Recycling Act requires any entity that wants the CEW recycling payment to register as a Covered Electronic Waste Recycler or a Collector ^[1]. Without registration you can still legally accept electronics, but the state won't pay you a cent. That means you're competing at a revenue disadvantage against registered shops who get paid per pound.

Second: DTSC authorization. If your facility physically processes e-waste (dismantling, shredding, separating, testing and wiping), you need some form of DTSC authorization. The common path for new shops is the Universal Waste Handler registration under the streamlined rules at 22 CCR 66273.70 ^[2]. Handlers skip the full hazardous waste facility permit as long as they accumulate universal waste, do not treat it, and ship it to a permitted destination facility. Start doing anything that counts as "treatment" under DTSC's definitions, and you cross into permit territory. That process takes much longer.

Third: local business license. Every California county and most cities require one. If your operation involves outdoor storage, loading docks, or chemical storage (even small amounts of cleaning solvent), you'll likely need a conditional use permit from local planning on top of the business license. Talk to the county assessor and the planning department before you commit to a building.

Fourth, optional but market-relevant: R2v3 or e-Stewards certification. These are not government licenses. They are third-party audited certifications that most large corporate and government ITAD clients require before they'll sign a contract. SERI (Sustainable Electronics Recycling International) manages R2. e-Stewards is managed by BAN (Basel Action Network). Neither is free. Neither is fast.

The mandatory floor is CalRecycle registration plus the right DTSC authorization. Everything above that is about winning customers.

How much does e-waste ITAD cost in California?

Cost tracks the tier of operation you're building. A solo data-destruction shop looks nothing like a full R2-certified recycler managing downstream vendors.

Here's a realistic first-year cost breakdown for a California e-waste ITAD operation. These ranges come from published fee schedules and certification body documentation, not numbers pulled from the air.

Cost Item	Low End	High End	Notes
CalRecycle registration	$0	$0	No fee in the statute; confirm at CalRecycle [1]
DTSC Universal Waste Handler registration	$0	$0	No state fee for handler status; permit fees apply if a full permit is needed [2]
DTSC full hazardous waste facility permit (if needed)	$10,000	$75,000+	Highly variable; state fees plus consultant costs
R2v3 initial certification (audit + cert body fees)	$5,000	$18,000	Varies by facility size and scope [3]
e-Stewards certification (alternative to R2)	$4,500	$15,000	BAN fee schedule
Facility lease (California, industrial, per year)	$36,000	$180,000	Bay Area vs. Inland Empire gap is large
Insurance (GL + pollution liability, first year)	$4,000	$14,000	Pollution riders vary sharply by coverage limit
Equipment (basic: shredder, degausser, audit software)	$15,000	$80,000	New vs. used changes everything
Legal/compliance consultant	$3,000	$20,000	Many skip this and regret it

CalRecycle registration costs nothing. That surprises most people. The money goes into everything around it: the facility DTSC requires you to maintain, the third-party certifications your customers demand, the insurance your landlord and clients insist on.

One honest reality about California: industrial real estate in Los Angeles, the Bay Area, and San Diego is some of the priciest in the country. The lease line will dominate your first-year budget in most metro areas. Operators in Riverside, San Bernardino, or Sacramento counties get real relief on rent, but then you eat transport costs if your customer base is coastal.

On the certification side, EWastePath's R2 / e-Stewards information kit (one-time $179 at /start) lays out the document path and pre-audit checklist, which saves a stack of expensive consultant hours before your first audit visit.

How long does e-waste ITAD take to set up in California?

Three to nine months is the honest range to get legally operational, assuming you don't need a full DTSC hazardous waste facility permit. If you do need that permit, add twelve to thirty-six months and serious attorney time.

Here's where the clock actually runs.

CalRecycle registration moves relatively fast. The application is online, and review typically takes four to eight weeks for a complete application. Incomplete applications, especially ones missing facility address details or proof of local business licensing, reset the clock ^[1].

DTSC universal waste handler status has no formal approval timeline because it's self-implementing. You notify DTSC, post the required information, and operate under the rules. But getting your facility inspection-ready takes time. Your waste storage areas, container labeling, emergency plan, and training records all have to be in place before your first accumulation day.

R2v3 certification is the longest leg for most new entrants. The process has four phases: application to a SERI-accredited certification body, document review (your quality manual, downstream vendor list, legal compliance records), an on-site audit, and corrective action closure. SERI's process documentation puts the full cycle at commonly three to six months from application to certificate, and that assumes you pass the first audit without major findings ^[3]. Major findings trigger a second visit and another fee.

Local permits can stall the whole thing. A conditional use permit from a city planning department runs sixty to one hundred eighty days on its own in many California jurisdictions. Do not sign a lease until you've talked to local planning about CUP requirements for your operation type.

Realistic timeline if you're organized: six months. Realistic timeline if you hit one snag (CUP delay, audit finding, incomplete DTSC paperwork): nine to twelve months.

What does CalRecycle actually require from registered recyclers?

CalRecycle's program under the Electronic Waste Recycling Act has two main registration categories: Collector and Recycler. Collectors accept covered electronic devices from consumers and institutions and aggregate them. Recyclers process the material and are the ones who receive recycling payments from the state ^[1].

To register as a Recycler, CalRecycle requires:

• A completed application with facility address and contact information
• Documentation of local business licenses
• A statement of the types of CEW accepted
• Compliance with all applicable environmental laws (DTSC authorization sits here)
• Agreement to CalRecycle's audit rights

Once registered, recyclers submit weight-based claims to receive recycling payments. Payment rates per pound are set by CalRecycle and updated periodically. Confirm current rates directly at CalRecycle, because they've moved over the program's history ^[1]. Registered recyclers also face random field audits where inspectors verify that reported weights match facility records.

Public Resources Code section 42475.2 requires that recycling payments go only to entities that meet the program's requirements and that the recycled materials are actually processed in ways that comply with the law. CalRecycle has decertified recyclers for weight fraud in past audit cycles, so your scale certifications and chain-of-custody records matter from day one.

If you're doing ITAD specifically (asset disposition, data destruction, then recycling), most clients want a certificate of data destruction before equipment leaves their site. CalRecycle's program doesn't regulate that document. NIST 800-88 is the federal guidance your clients will cite, and NAID AAA certification is what many government contracts require on top of R2 ^[5].

What does DTSC require for an e-waste processing facility in California?

DTSC's jurisdiction over e-waste comes mainly from the universal waste rules at 22 CCR 66273 and the broader hazardous waste management regulations at 22 CCR 66000 et seq ^[2].

For most entry-level ITAD operations, the universal waste handler pathway is the right starting point. Under it:

• You can accumulate universal waste (CRT devices, mercury-containing equipment, and electronic devices that meet the universal waste definition) for up to one year
• You label containers and storage areas with the accumulation start date and the words "Universal Waste"
• You prevent releases, manage containers to avoid breakage, and keep an emergency plan
• You cannot treat universal waste on-site, and treatment means processing, reclaiming, or recovering the hazardous constituents

The treatment prohibition is where ITAD operators most often trip. Physically disassembling a device to separate components for downstream recycling has been read by DTSC in some instances as treatment. Before you design your facility workflow, get a written determination from DTSC or hire a DTSC-registered hazardous materials consultant to review your process. This is not an area to interpret yourself from the regulation text.

If your business model involves downstream processing (shredding, smelting, acid leaching for precious metal recovery), you need a full Hazardous Waste Facility Permit under Health and Safety Code 25200 ^[6]. That is a multi-year, resource-heavy process, and it sits outside the scope of most new ITAD entrants.

Some California operators sidestep the treatment question by doing only data destruction and cosmetic sorting on-site, then shipping intact devices to a permitted downstream recycler. That's a clean compliance posture. It also trims your margin.

How does R2v3 certification work for California ITAD operators?

R2v3 (Responsible Recycling version 3) is the third iteration of the SERI standard. It's the most widely accepted third-party certification for ITAD and electronics recycling in the US, California included ^[3].

The standard requires certified facilities to:

• Maintain an environmental, health, and safety management system (similar in structure to ISO 14001)
• Identify and manage "focus materials" (items with heightened environmental risk, including CRTs, batteries, and mercury-containing devices) to specific requirements
• Verify and document downstream vendor certifications so the recycling chain stays clean all the way to end processing
• Maintain data security processes for storage media
• Comply with all applicable legal requirements, which in California means CalRecycle registration and DTSC authorization

R2v3 was issued in 2020, and SERI required all previously R2v2-certified facilities to transition to v3 by December 31, 2022 ^[3]. Starting fresh means you apply to R2v3 directly.

Certification cost depends on which SERI-accredited certification body you use (roughly a dozen are active in the US) and on your facility's square footage and scope. Smaller facilities with limited scope (data destruction and collection only, no processing) tend to land at the lower end of the $5,000 to $18,000 range. Full-processing facilities with multiple downstream streams pay more.

A common mistake: operators try to get R2 certified before they're fully compliant with California-specific requirements. Auditors check legal compliance as part of the standard. Walk into your R2 audit with your CalRecycle registration confirmed and your DTSC authorization documented, or you'll have a finding on day one.

For a walkthrough of the R2v3 document checklist, EWastePath's kit at /start covers what auditors actually look at and what to prepare before you pay for your first audit visit.

What are the California Electronic Waste Recycling Act's covered device rules?

The Electronic Waste Recycling Act defines "covered electronic devices" (CEDs) at Public Resources Code 42463. The definition has shifted since the program launched in 2003 and currently includes video display devices with screens four inches or larger measured diagonally ^[1].

The law also requires manufacturers to pay into a recycling fund and bans certain hazardous materials in new devices sold in California, mirroring parts of the EU RoHS directive. For ITAD operators, the relevant part is simpler: any device that qualifies as a CED is eligible for the CEW recycling payment when a registered recycler processes it.

California's CEW recycling payment has historically been structured by weight and device category. Rates are published by CalRecycle and updated periodically. In recent program years, CalRecycle has adjusted rates based on fund balance and recycling volumes. Confirm current rates at CalRecycle's official program page before you build your financial model, because what was true two years ago may not hold today ^[1].

Devices that are not CEDs under the act (servers, networking gear, printers, phones) are still subject to DTSC universal waste rules if they contain hazardous materials, but they don't generate CEW payments. Many California ITAD operators build a blended business: CEW-eligible devices bring program revenue, while non-CED assets get monetized through refurbishment and parts resale.

How does California compare to other states for e-waste ITAD entry costs?

California is one of the more expensive states to enter as an ITAD operator. It also offers the largest addressable market in the country.

A few comparison points:

State	Producer-funded program?	Recycler registration fee	Facility real estate cost	R2 required by state law?
California	Yes (CalRecycle CEW)	$0 (confirm with CalRecycle)	Very high in coastal metros	No, but customers require it
Colorado	Yes (HB21-1315 producer responsibility)	Varies by role; confirm CDPHE	Moderate	No
Florida	No state recycling payment program	No state ITAD-specific registration	Moderate	No
Illinois	Yes (Illinois E-Waste Recycling Act)	Varies; confirm IEPA	Moderate	No
Arizona	No producer-funded program	No state ITAD-specific registration	Low to moderate	No

The "no state registration fee" line for California is real but misleading about total entry cost. What California adds is regulatory complexity, expensive commercial real estate, and some of the strictest DTSC enforcement in the country. A California operation that passes a DTSC inspection and an R2 audit is genuinely well-run. The state's requirements push operators toward real compliance.

For comparison by region, our state guides cover e-waste ITAD board in Arizona, e-waste ITAD board in Colorado, and e-waste ITAD board in Florida, each taking a different regulatory approach. Some Southeast markets, like e-waste ITAD board in Georgia, carry notably lighter state-level requirements and may appeal to operators who want a lower-friction first market.

What insurance does a California e-waste ITAD business need?

California sets no single statutory insurance minimum for ITAD, but several requirements converge into a practical floor.

General liability insurance ($1 million per occurrence, $2 million aggregate) is standard and expected by facility landlords, corporate clients, and CalRecycle auditors. Most commercial property leases in California specify GL minimums, and some name environmental or pollution liability as a condition of tenancy.

Pollution liability coverage is the one most new operators underestimate. If your facility has a CRT breakage event or a solvent spill, standard GL policies typically exclude pollution claims. A standalone pollution liability policy covering your site and transportation operations runs roughly $3,000 to $8,000 a year for a small California facility, though the range is wide depending on your coverage limits and the insurer's read on your hazardous materials profile.

If you provide data destruction and certify asset wipes, clients increasingly require professional liability (errors and omissions) coverage. A data breach tied to an inadequately wiped drive creates exposure GL won't cover. E&O policies for ITAD operators typically start around $2,000 to $5,000 a year for a small shop.

Workers' compensation is mandatory in California for any operation with employees, part-timers included, under Labor Code 3700 ^[7]. ITAD work involves lifting, lead dust exposure in older equipment, and ergonomic risks, so your workers' comp carrier will want to see your safety program and job classifications before quoting.

For operations doing pickup and transport, commercial auto insurance covering the weight class of your vehicles is also required. If you're hauling large quantities of e-waste, check whether your auto policy needs an environmental endorsement for the cargo.

What does data destruction compliance look like under California law?

California has some of the strongest data privacy laws in the country, and they touch your ITAD business directly.

The California Consumer Privacy Act (CCPA), as amended by Proposition 24 (CPRA), requires businesses that handle personal information to dispose of it in ways that prevent unauthorized access ^[8]. When your clients are California businesses, their CCPA obligations flow practical requirements to you: they need to show that assets you received were wiped or destroyed in compliance with the law.

For storage media, NIST Special Publication 800-88 (Guidelines for Media Sanitization) is the federal standard most enterprises and government agencies reference in their data destruction contracts ^[5]. California state agencies follow this guidance under their own information security policies. If you want government and enterprise contracts here, your certificates of data destruction need to reference NIST 800-88 methods (Clear, Purge, or Destroy) and document what was done to each asset by serial number.

HIPAA layers additional requirements for healthcare clients, a large ITAD market in California. If you intend to serve hospitals or medical groups, HIPAA's physical safeguard requirements under 45 CFR 164.310 apply to the PHI on media you receive ^[9]. A signed Business Associate Agreement with healthcare clients is not optional.

NAID AAA certification (from i-SIGMA) is the third-party credential most recognized for data destruction specifically, separate from R2. Some California government contracts list NAID AAA as a contractor requirement. It covers physical destruction of media and on-site destruction services.

Practical first steps for starting e-waste ITAD in California

Here's the sequence that makes the most sense given how California's regulatory calendar actually runs.

Step one: secure your facility before you apply for anything. Your CalRecycle registration requires a facility address, and your DTSC notifications are address-specific. Don't submit applications until you have a signed lease on a building local planning has confirmed is zoned for your operation type.

Step two: confirm local zoning and business license requirements. Go to the city or county planning department, describe your operation in plain language (receiving, storing, and processing electronic waste), and ask what permits they require. Do this before you sign the lease.

Step three: file your CalRecycle registration application online. Be complete. Incomplete applications add weeks. Attach your local business license documentation when you have it ^[1].

Step four: review your operation against DTSC's universal waste handler rules at 22 CCR 66273. If you're not doing treatment, document why your process falls within the handler exemption. If you're unsure, hire a DTSC-registered hazardous materials consultant for a half-day review before your first day of accumulation ^[2].

Step five: begin the R2v3 pre-certification process. Get quotes from two or three SERI-accredited certification bodies, because prices vary. Build your quality manual and downstream vendor documentation in parallel with your CalRecycle registration. These take longer than most people expect.

Step six: place your insurance before you open. Don't assume your general business insurer understands e-waste. Work with a broker who has placed pollution liability for recyclers before.

Comparing California's entry path to lighter-regulation states? The guides for e-waste ITAD board in Arizona, e-waste ITAD board in Colorado, and e-waste ITAD board in Illinois are worth reading alongside this one.

Frequently asked questions

Do you need a license for e-waste ITAD in California?

Yes, multiple authorizations. At minimum you need CalRecycle registration under the Electronic Waste Recycling Act (Public Resources Code 42460 et seq.) to receive state recycling payments, plus appropriate DTSC authorization (typically Universal Waste Handler status under 22 CCR 66273) to legally store and ship e-waste. Local business licenses and conditional use permits from city or county planning are also required. R2 or e-Stewards certification isn't a legal requirement but is commercially necessary for most enterprise clients.

How much does e-waste ITAD cost to start in California?

CalRecycle registration and Universal Waste Handler status carry no state fee, but the surrounding costs add up fast. R2v3 certification runs $5,000 to $18,000 in audit and certification body fees. Industrial facility leases range from $36,000 to $180,000+ per year depending on region. Insurance (GL plus pollution liability) typically runs $4,000 to $14,000 in year one. Total first-year costs for a properly set-up operation commonly land between $80,000 and $300,000+.

How long does e-waste ITAD take to set up in California?

Three to nine months is realistic for new entrants who don't need a full DTSC hazardous waste facility permit. CalRecycle registration typically takes four to eight weeks once the application is complete. R2v3 certification runs three to six months from application to certificate. Local conditional use permits in California cities can take sixty to one hundred eighty days on their own. Full DTSC facility permits, if required, add twelve to thirty-six months.

What is CalRecycle's role in California e-waste recycling?

CalRecycle administers the Electronic Waste Recycling Act program, which funds e-waste collection and recycling through a fee consumers pay at point of sale. CalRecycle registers collectors and recyclers, sets recycling payment rates per pound for covered electronic devices, and audits registered facilities. You can't receive state recycling payments without CalRecycle registration. CalRecycle doesn't regulate hazardous waste handling; that's DTSC's job.

What is DTSC's role in California e-waste ITAD?

The Department of Toxic Substances Control regulates hazardous waste handling in California, which covers most e-waste containing lead, mercury, or cadmium. ITAD facilities that store e-waste must operate under DTSC's Universal Waste Handler rules at 22 CCR 66273 or hold a full hazardous waste facility permit. DTSC conducts inspections and can shut down facilities operating outside their authorized status. It's separate from CalRecycle and requires separate compliance documentation.

Is R2 certification required by California law?

No. Neither R2v3 nor e-Stewards is required by California statute. CalRecycle registration and DTSC authorization are the legal requirements. R2 or e-Stewards certification is practically required, though, to win contracts with large enterprises, government agencies, and healthcare clients. Most California RFPs for ITAD services list R2 certification as a mandatory vendor qualification, so legal and commercial requirements are different things here.

What are covered electronic devices (CEDs) under California law?

California Public Resources Code section 42463 defines covered electronic devices as video display devices with screens four inches or larger measured diagonally. This includes CRT monitors and televisions, flat-panel monitors, and laptops. Phones, tablets, printers, and servers are generally not CEDs under the current definition, though DTSC universal waste rules still apply to them if they contain hazardous materials. Only CEDs generate CalRecycle recycling payments.

Do California e-waste ITAD operators need pollution liability insurance?

California sets no statutory pollution liability minimum for ITAD operators, but standard general liability policies exclude pollution claims. If you store CRTs, batteries, or solvents at your facility, a CRT breakage or spill generates cleanup costs your GL won't cover. Most facility landlords and enterprise clients in California also require pollution liability by contract. Policies for small ITAD facilities typically run $3,000 to $8,000 a year; confirm with a broker who handles environmental accounts.

What data destruction standard do California clients expect?

NIST Special Publication 800-88 (Guidelines for Media Sanitization) is the standard referenced in most California enterprise and government ITAD contracts. Healthcare clients also require HIPAA compliance under 45 CFR 164.310 and a signed Business Associate Agreement. NAID AAA certification from i-SIGMA is commonly listed as a mandatory contractor qualification in California government RFPs for data destruction. Your certificates of data destruction should reference the specific NIST 800-88 method used for each asset.

How does the CCPA affect California e-waste ITAD businesses?

The California Consumer Privacy Act (as amended by CPRA) requires businesses handling personal information to dispose of it securely. When your ITAD clients are California businesses subject to CCPA, they have to document that assets you received were properly sanitized or destroyed. That obligation flows to you contractually: you issue serial-number-level certificates of data destruction that let clients prove CCPA compliance. Without that documentation trail, enterprise clients won't use you.

Can I start an e-waste ITAD business in California without physical processing?

Yes. Many California ITAD operators do only data destruction and collection on-site, then ship intact devices to a permitted downstream processor. That keeps you inside the Universal Waste Handler exemption without a full DTSC facility permit or R2 processing scope. It simplifies compliance but cuts your margin per unit. You still need CalRecycle registration, local business licensing, DTSC handler compliance, and adequate insurance. You also need to verify your downstream processor's R2 or e-Stewards status for your own R2 audit.

What records does CalRecycle require from registered recyclers?

CalRecycle requires registered recyclers to keep weight records for all covered electronic waste received and processed, supporting documentation for recycling payment claims, and records showing compliance with applicable environmental laws. Auditors can inspect these during announced and unannounced site visits. Weight fraud (inflating poundage to claim excess recycling payments) has led to decertifications in past audit cycles. Calibrated, certified scales and clean chain-of-custody logs from intake to shipment are not optional.

How do California's e-waste rules compare to neighboring states?

California has one of the most complex state e-waste frameworks in the country, with both a producer-funded recycling payment program (CalRecycle) and active DTSC hazardous waste enforcement. Arizona has no producer-funded program and lighter state ITAD-specific requirements, making entry easier. Colorado has a newer producer responsibility law with different mechanics. The California market is also the largest in the US, so the regulatory overhead comes with a revenue opportunity smaller states don't offer.

What happens if I collect e-waste in California without CalRecycle registration?

Operating without CalRecycle registration means you cannot receive state CEW recycling payments, a direct revenue loss. More seriously, if you make false claims for unregistered facilities or handle hazardous e-waste without DTSC authorization, California's penalties can include administrative fines, stop-work orders, and in egregious cases criminal referral under the hazardous waste laws. Registration is free. There's no reason to skip it.

Sources

1. California Public Resources Code, Electronic Waste Recycling Act, section 42463 (CalRecycle): CalRecycle administers the Electronic Waste Recycling Act; covered electronic devices are video display devices with screens four inches or larger; registration is required to receive recycling payments; no registration fee is listed in the statute
2. California Code of Regulations, Title 22, Division 4.5, Chapter 23, Section 66273 (DTSC Universal Waste Rule): Universal Waste Handler rules govern accumulation, labeling, and shipping of electronic devices containing hazardous materials; treatment on-site by handlers is prohibited
3. SERI (Sustainable Electronics Recycling International), R2v3 Standard and Certification Overview: R2v3 issued 2020; all facilities required to transition from R2v2 to R2v3 by December 31, 2022; certification involves document review and on-site audit by an accredited certification body; costs vary by facility scope
4. NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization (National Institute of Standards and Technology, 2014): NIST 800-88 defines Clear, Purge, and Destroy methods for storage media sanitization; widely referenced in enterprise and government ITAD contracts including California agencies
5. California Health and Safety Code, Section 25200 (Hazardous Waste Facility Permit requirement): Any facility that treats, stores, or disposes of hazardous waste in California requires a DTSC-issued hazardous waste facility permit under HSC 25200
6. California Labor Code, Section 3700 (Workers' Compensation requirement): Workers' compensation insurance is mandatory in California for any employer with employees, including part-time workers
7. California Civil Code, Section 1798.100 et seq. (California Consumer Privacy Act as amended by CPRA): CCPA as amended by CPRA requires businesses handling personal information to dispose of it in ways that prevent unauthorized access; relevant to ITAD clients' data destruction documentation obligations
8. HHS, HIPAA Security Rule, 45 CFR 164.310 Physical Safeguards: HIPAA physical safeguard requirements at 45 CFR 164.310 apply to PHI on media received by ITAD operators serving healthcare clients; Business Associate Agreements are required
9. California DTSC, Hazardous Waste Management Program: DTSC regulates hazardous waste facility permits, conducts inspections, and can issue stop-work orders for facilities operating without required authorizations
10. Cal/OSHA, California Code of Regulations, Title 8, Section 5198 (Lead): Cal/OSHA 8 CCR 5198 applies to workplaces where workers may encounter lead-containing components, including e-waste operations handling CRTs and older circuit boards