Often it isn’t. A quick format or an unverified wipe can leave customer records, payroll data and passwords sitting on a drive that’s about to be resold or recycled. What actually protects you is sanitization that follows a recognized standard, is checked afterwards, and is backed by a certificate for every device.
Why Deleting Files Doesn’t Make Data Disappear
When you delete a file or format a drive, the operating system usually just removes the references to where the data sits. The data itself stays on the disk until something overwrites it, and free recovery software can often bring it back.
That means every retired computer, server or storage device is a potential leak. If it leaves the building without proper sanitization, it could still hold customer data, employee records, financial information, passwords or intellectual property.
Three Main Methods of Data Destruction
NIST SP 800-88, the US government’s guidelines for media sanitization, sorts every method into three categories. Clear protects against simple recovery tools. Purge protects against advanced lab techniques. Destroy leaves the media physically unusable. Revision 2, published in September 2025, keeps those categories and points to the IEEE 2883 standard for media-specific techniques.
NIST 800-88 Compliant Wiping
Software wiping overwrites or erases the data so the drive can be used again. It’s the right choice when equipment still works and you want to resell or redeploy it. Traditional hard drives can be overwritten. For SSDs, overwriting is unreliable because of how flash memory spreads data around, so cryptographic erase or the drive’s built-in sanitize commands are used instead. NIST also notes that multi-pass overwriting isn’t needed for SSDs. Whatever the method, each drive should be verified afterwards to confirm the wipe actually worked.
Degaussing
Degaussing uses a powerful magnetic field to scramble the data on magnetic media such as hard drives and backup tapes. NIST classes it as a Purge method. Two things to know: it also wipes the drive’s own control data, so a degaussed hard drive can’t be reused, and the degausser has to be strong enough for the media, or it can fail. It does nothing to SSDs or USB flash drives, which store data electronically.
Physical Shredding
Shredding breaks drives into small fragments and remains one of the most common destruction methods. It suits damaged drives that can’t be wiped and devices that won’t be reused. It isn’t automatically the strongest option, though. NIST’s latest guidance notes that IEEE 2883 deprecates shredding for modern drives, because data on today’s dense platters and flash chips can survive on fragments, and it recommends incineration for SSDs holding medium or high-security data. If you rely on shredding, ask what particle size your provider shreds to.
What a Certificate of Destruction Should Include
A certificate of data destruction is your proof that a device was sanitized or destroyed properly. NIST recommends that organizations require certificates as part of their sanitization policy. A useful one should list, for every device:
- Serial number, manufacturer and model
- The method used and the standard followed
- The date and the person or company who carried it out
- Whether verification passed
Why Serialized Reporting Matters
Serialized reporting ties each certificate to a specific device’s serial number, so every drive in your inventory can be matched to its destruction record. That gives you a full audit trail if you ever need to investigate an incident, check a vendor’s work or prove that nothing slipped through. Without it, you may know a batch of drives was destroyed but not be able to prove that one particular drive was among them.
Data Destruction and Compliance
GDPR
Under the GDPR, personal data shouldn’t be kept longer than needed (storage limitation) and must be kept secure (integrity and confidentiality). The accountability principle in Article 5(2) also says you must be able to demonstrate compliance, which is where serialized certificates earn their place.
HIPAA
The HIPAA Security Rule requires covered entities to have policies for the final disposal of electronic protected health information and the hardware it’s stored on, and procedures to remove it before media is reused. HHS guidance doesn’t require a specific method but points to NIST SP 800-88 as a resource.
Neither regulation names a specific certificate. But documented, serialized evidence that each device was handled to a recognized standard is the strongest way to show you met your obligations. Working with a provider like Comsources, whose IT asset disposition solution includes NIST 800-88 wiping and certificates of data destruction, means that evidence is part of the process rather than something you try to piece together after an audit request.