Whatever sector a business is in, retail, hospitality, professional services, manufacturing or a general office, this is one of the most common questions we hear. What actually counts as proper IT disposal, and what should a business be receiving as proof it was done?
A certificate of data destruction is the document that proves the personal data on a specific device was permanently destroyed, not just deleted or formatted, but destroyed to a standard that makes recovery impossible. It is the paperwork your data protection lead files, and the paperwork you would need to produce if a client, auditor or the ICO ever asked how your business handles retired IT equipment.
Why a Format or Factory Reset Is Not Enough
Deleting files or reformatting a drive does not remove the data. It removes the reference to where the data is stored, while the data itself remains on the drive until it is overwritten, and it can often be recovered using software that is freely available online. This is why the UK GDPR and ICO guidance both point to the same standard: certified destruction, backed by documentation.
What EcoTech IT’s Certificate Includes
EcoTech IT issues an itemised certificate of data destruction for every device we process. Each certificate lists the make, model and serial number of the device, the method used to destroy the data, whether that is NIST 800-88 compliant wiping or physical destruction, and the date the device was processed. Learn more about GDPR Compliant Data Disposal for UK Businesses and Schools
Frequently Asked Questions
- Is a certificate of data destruction a legal requirement?
The UK GDPR requires businesses to demonstrate that personal data has been permanently destroyed. A certificate of data destruction is how that gets evidenced.
- Do I get a certificate for every device, or one certificate covering a whole collection?
A: EcoTech IT issues an itemised certificate listing every device individually, by make, model and serial number, rather than a single statement covering the whole collection.
- What if a device is too damaged to be wiped?
A: Devices that cannot be powered on are physically destroyed instead of wiped. Either way, the device is included on your certificate of data destruction, with the method clearly recorded.
- My business only has a handful of old laptops. Is it still worth getting a certificate?
A: Yes. The size of the collection does not change the obligation. Any business holding personal data on retired hardware should have documented proof of how it was destroyed, regardless of how many devices are involved.