Castle Water

Other United Kingdom Website Reviewed Sept. 22, 2026

Castle Water Limited is a Scotland-based business water and wastewater retailer supplying non-household customers across England and Scotland.

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO/IEC 27001:2022 SGS United Kingdom Ltd Cert GB22/00000184, Castle Water Limited, Blairgowrie: protection of client and employee data for commercial operations and the provision of customer services for a water company (SoA v4.0). June 1, 2022 June 1, 2028 Current
ISO 9001:2015 SGS United Kingdom Ltd Cert GB19/964924, Castle Water Limited: the provision of water and wastewater retail services. Dec. 10, 2019 Oct. 10, 2028 Current

Compliance Frameworks

ISO/IEC 27001:2022
Full
SGS certificate GB22/00000184 valid to 1 Jun 2028, with a named entity and a published scope statement.
ISO 9001:2015
Full
SGS certificate GB19/964924 valid to 10 Oct 2028.
GDPR 2016/679
Partial
Privacy policy updated March 2026 with a Data Protection Team and [email protected]; no individual named, no ICO number, no DPA.

Contact & Responsible Disclosure

Strongest evidence of the water retailers

Castle Water publishes **two full SGS certificate PDFs** with certificate numbers, named entity, scope statements and dates — the best documentation in this part of the library.

**Licensing — WICS (Scotland), verified:** licensed provider "Castle Water", general water and sewerage services licences granted **11 July 2014**. Cobalt Water licences transferred June 2020, Affinity for Business July 2021, Brightwater Services April 2026.

**Ofwat (England): unverified.** Ofwat publishes water supply and sewerage licence pages for Castle Water Limited plus a wholesale authorisation application, but the Ofwat register returned HTTP 403 to automated checks — verify manually.

No ISO 14001, 45001, 22301, 50001 or Cyber Essentials evidence found. Entities: Castle Water Limited (SC475583) and Castle Water (Scotland) No.2 Limited (SC514287).

Assess Castle Water in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.