How is data destroyed — and how is it certified?

The three methods, and what each one is for

There are three recognised approaches to removing data from a storage device at end of life. They are not interchangeable, and a competent provider will pick between them based on the device type, its condition and your policy — not on which one is cheapest to run.

1. Software erasure (overwriting)

Certified erasure software overwrites every addressable location on the drive, then reads the drive back to verify that the overwrite actually happened. That verification step is the part that distinguishes erasure from wishful thinking: an unverified wipe on a drive with failing sectors can leave readable data behind and report success.

Done properly, erasure is the preferred method for equipment with resale value, because it leaves a fully working device. NIST SP 800-88 Rev. 1 — the reference guideline most UK providers work to — describes this as 'Clear' or, using the drive's internal sanitise commands, 'Purge'. For SSDs, a simple overwrite is not sufficient on its own, because wear levelling means the controller may not expose every physical cell to the write; the firmware-level sanitise command is what does the job.

2. Degaussing

A degausser applies a magnetic field strong enough to destroy the magnetic domains that store data on a spinning hard drive. It is fast, it works on drives that are too damaged to erase in software, and it renders the drive permanently unusable — the servo tracks the drive needs to operate are erased along with your data.

3. Physical destruction (shredding or crushing)

Shredding reduces the drive to fragments. For SSDs and flash media, the shred particle size matters — a chip that survives intact could in principle be read, so flash media needs a finer shred than a mechanical hard drive does.

Physical destruction is the right answer where policy demands it, where a drive has failed beyond erasure, or where the equipment has no resale value anyway. It is the wrong answer for a fleet of two-year-old laptops with real residual value — you are destroying money to buy a feeling of certainty that verified erasure would have given you anyway.

Why deleting and formatting are not on that list

Deleting a file removes the pointer to it. Formatting a drive rebuilds the index. In both cases the data itself remains on the platters or in the flash cells until something overwrites it, and freely available recovery tools will find it.

This matters more than it used to, because the recovery does not need to be sophisticated to be damaging. Under UK GDPR, personal data that is recoverable from a disposed device is personal data you are still responsible for.

What a genuine destruction certificate contains

A certificate that covers 'a collection of IT equipment' is not evidence. It cannot be tied to a specific device, so it cannot answer the only question anyone will ever ask you: what happened to this particular machine?

A certificate worth filing records, for each individual device:

• The serial number of the device or drive — the unique identifier that ties the certificate to your asset register
• The make, model and capacity, so the record is legible without the device in front of you
• The method used — the specific erasure standard applied, or the physical destruction method
• The verification result, confirming the process was checked rather than assumed
• The date and time the process was carried out
• The operator or technician responsible
• The issuing company's details and licence or registration numbers

Chain of custody: the part certificates cannot cover

A destruction certificate proves what happened at the end. It says nothing about the hours or days between equipment leaving your building and reaching the machine that destroyed it — which is precisely the window in which devices go missing.

That gap is closed by process, not paperwork: assets scanned and logged at your premises rather than at the depot, sealed transport, vetted and directly employed drivers, and a reconciliation between what was collected and what was processed. If a provider itemises only after equipment reaches their facility, the register they produce cannot tell you whether anything was lost on the way.

When destruction should happen on your premises

For most organisations, off-site processing with a documented chain of custody is proportionate. For some — regulated financial services, healthcare handling particularly sensitive records, and organisations whose own policy simply forbids it — data must not leave the building in a readable state at all.

On-site destruction resolves this by bringing the shredder or degausser to you. Drives are destroyed in front of your witness, certificates are issued before the vehicle leaves, and only scrap travels. It costs more per device, and for the right organisation it is worth every penny of the difference.