What Is a Certificate of Data Destruction?

A certificate of data destruction, sometimes called a certificate of sanitisation or certificate of erasure, is a record issued by the organisation that destroyed the data. It states which devices were processed, how, when and with what result. Auditors, regulators and clients ask for it because it is the only practical evidence that data on retired equipment no longer exists.

What a good certificate includes

• Unique certificate number and your company name
• Device details: type, make, model, serial number
• Storage details: drive serial, type and capacity
• Method and level: for example NIST SP 800-88 Purge, cryptographic erase, or shredding
• Verification result: passed or failed, and what happened to failed drives
• Date, location and operator
• Chain of custody reference: the job or collection it belongs to

Per device or per batch?

A single batch certificate that says “500 laptops wiped” is weak evidence. If a question arises about one device, you need to show what happened to that serial number. Serial-level records, either one certificate per device or a batch certificate with a full serial-level appendix, are the standard to ask for.

Warning signs

• No serial numbers
• No method or standard named
• No verification result
• Certificates issued before the equipment was processed

Example

Here is the kind of record we issue for each device:

Keep certificates with your asset register, so each retired asset has a disposal record.