It’s one of the most common questions we get from schools, engineering firms, architectural practices, and offices across Wiltshire: what actually counts as “proper” IT disposal, and what should you be receiving as proof?
A certificate of data destruction is the document that proves the personal data on a specific device was permanently destroyed not just deleted, not just formatted, but destroyed to a standard that makes recovery impossible. It’s the paperwork your data protection officer files, and the paperwork you’d need to produce if the Information Commissioner’s Office (ICO), a governing body, or a client’s due diligence process ever asked how your organisation handles end-of-life IT equipment. Learn more about Secure Data Destruction for Schools
Why a Format or Factory Reset Isn’t Enough
Deleting files or reformatting a drive does not remove the data. It removes the reference to where the data is stored, the data itself remains on the drive until it’s overwritten, and it can often be recovered using software that’s freely available online. This is why the UK GDPR and ICO guidance both point to the same standard: certified destruction, with documentation, not a good-faith wipe with nothing to show for it. Learn more about GDPR Compliant Data Disposal for Schools and Businesses in Wiltshire
What EcoTech IT’s Certificate Includes
EcoTech IT issues an itemised, serialised certificate of data destruction for the devices we process. Each certificate lists:
– The make, model, and serial number of the device
– The method used to destroy the data (NIST 800-88 compliant wiping, or physical destruction)
– The date the device was processed
This level of detail is what separates a certificate that actually protects your organisation from a generic letter that says “your equipment has been recycled.”
FAQs
Q: Is a certificate of data destruction a legal requirement?
A: The UK GDPR requires organisations to demonstrate that personal data has been permanently destroyed. A certificate of data destruction is how you evidence that. It’s the practical answer to a legal obligation, rather than a separate requirement in its own right.
Q: Do I get a certificate for every device, or one certificate covering a whole collection?
A: EcoTech IT issues an itemised certificate that lists every device individually by make, model, and serial number rather than one blanket statement covering an entire collection.
Q: What if a device is too damaged to be wiped?
A: Devices that can’t be powered on are physically destroyed instead of wiped. Either way, the device is included on your certificate of data destruction, with the method used clearly recorded.
Q: How long should we keep our certificates on file?
A: Most data protection advisers recommend keeping disposal records for as long as your organisation’s general data retention policy specifies, so they’re available if a query or audit arises later. EcoTech IT recommends keeping all documents for a minimum of 2 years.