Chain of custody in secure data destruction is the documented record of who controlled data-bearing assets, where those assets were held and when responsibility passed from one person, team or organisation to another.

Its purpose is to prevent gaps in accountability.

A hard drive may eventually be shredded, degaussed or otherwise securely sanitised, but the period before destruction is just as important. If the device contains confidential, commercially sensitive or personal information, that information may remain recoverable while the asset is awaiting collection, in transit or waiting to be processed.

A strong chain of custody therefore provides continuity from the point an asset is released for disposal through to its final destruction or sanitisation.

The National Cyber Security Centre advises that organisations should have appropriate tracking when assets are transferred between individuals or teams and notes that sensitive or valuable assets may require a more detailed chain-of-custody type of tracking.

For compliance teams, that means secure data destruction should not be viewed simply as the final moment when a device is physically destroyed. The entire journey to that point matters.

What does chain of custody mean in practice?

In practical terms, chain of custody means being able to account for an asset during every stage where responsibility changes.

Imagine an organisation retiring a batch of hard drives from a server environment.

The process may include several stages:

• the drives are removed from service;
• they are placed into secure storage;
• they are released to an authorised collection team;
• they are transported to a destruction facility;
• they are received and checked;
• they are processed;
• destruction records are produced.

Each stage creates a potential handover.

A chain-of-custody process records those handovers so the organisation can demonstrate that the assets did not simply disappear into an uncontrolled disposal route.

The important principle is continuity. There should not be an unexplained period where nobody can establish where the assets were, who had access to them or who was responsible for them.

Why does chain of custody matter before the data is destroyed?

Data-bearing equipment remains a security risk until the information it contains has been appropriately sanitised or destroyed.

A hard drive sitting in a storeroom may be obsolete from an IT perspective, but the data on it may still be fully recoverable.

Similarly, a device placed in a transport container has not become safe simply because it has left the server room.

The ICO specifically identifies this risk in its records-management guidance. It recommends securely storing electronic devices awaiting destruction, keeping a log of devices and their locations and maintaining suitable controls around disposal.

This makes chain of custody an important bridge between operational asset management and final data destruction.

The destruction method deals with the data itself. Chain of custody deals with controlling the asset until that destruction occurs.

When does the chain of custody begin?

A useful chain of custody can begin before a third-party destruction provider is involved.

For example, once a hard drive is removed from active use, the organisation may need to know:

• who removed it;
• where it was placed;
• whether it is awaiting sanitisation or physical destruction;
• who is authorised to access the storage area;
• when it is due to leave the premises.

The ICO recommends keeping hardware awaiting destruction in a locked area with limited access and maintaining destruction logs covering the relevant assets.

That means an organisation’s internal handling controls form part of the wider assurance process.

If several days pass between decommissioning and collection, those days should not create an accountability gap.

When does the chain of custody end?

For secure destruction, the chain normally needs to extend until the organisation has sufficient evidence that the asset reached its intended endpoint.

That endpoint may be secure sanitisation, physical destruction or another approved disposal outcome, depending on the media and the organisation’s requirements.

A useful principle is that custody should not simply end when the equipment leaves the original premises.

If a third-party provider takes possession of the assets, responsibility for physical handling has changed, but the organisation still needs appropriate assurance over what happens next.

The ICO advises organisations to obtain evidence of secure disposal from third parties and to assign responsibility for checking that destruction certificates match what was sent for destruction.

The record should therefore connect the original release of the assets with the final evidence showing that the agreed process was completed.

What information should a chain-of-custody record contain?

There is no single universal format suitable for every organisation.

The appropriate level of detail depends on the sensitivity of the assets, the organisation’s internal policies, contractual requirements and the assurance level required.

However, a useful chain-of-custody record will normally make it possible to establish:

• what assets or containers were handed over;
• who released them;
• who received them;
• the date and time of transfer;
• the relevant location;
• whether seals or secure containers were used;
• any asset, batch or consignment references;
• subsequent transfer points;
• the final destruction or sanitisation outcome.

Some organisations may track individual serial numbers. Others may use tamper-evident container numbers, batch references or consignment identifiers as part of the process.

These controls are related but should not be confused.

A serial number helps identify which device is involved.

Chain of custody helps establish who controlled it and when.

Used together, they can provide a much clearer audit trail.

What does a custody handover actually prove?

A handover record does not prove that the data has already been destroyed.

Instead, it shows that responsibility for the asset changed in a controlled and documented way.

For example, if an authorised employee releases a sealed container containing data-bearing media to an authorised collection representative at 10:15am, both parties can record that transfer.

The next stage might show the same consignment arriving at the processing location.

That sequence helps create evidential continuity.

If questions arise later, the organisation can reconstruct the movement of the assets rather than relying on memory or assumptions.

This distinction matters because different records prove different things.

A handover record shows custody.

A destruction record shows processing.

An asset register identifies equipment.

A certificate may provide evidence that an agreed destruction activity occurred.

Good governance comes from linking those records rather than expecting one document to perform every function.

What can go wrong when chain of custody is weak?

The most obvious risk is an unexplained gap.

Suppose ten data-bearing drives are removed from an IT room on Monday but are not formally recorded as received by the destruction provider until Wednesday.

If the organisation cannot account for where they were during that period, it has a traceability problem even if all ten drives were ultimately destroyed.

Other weaknesses can include assets being left in unlocked areas, informal handovers between staff, unidentified containers, records completed retrospectively or discrepancies between what was collected and what was ultimately processed.

The ICO warns that personal information may be exposed if electronic records are not protected before, during and after disposal, and links inadequate secure disposal controls with potential breaches of UK GDPR Articles 5(1)(f) and 32.

The issue is therefore not just administrative neatness.

Poor custody controls can increase the opportunity for loss, unauthorised access, substitution or accidental disposal through the wrong route.

Does using a third-party destruction company remove the organisation’s responsibility?

No.

Using a specialist provider can help organisations manage secure destruction, but outsourcing the physical work does not mean outsourcing all accountability.

The organisation should still establish that the provider’s processes are appropriate for the information and assets involved.

The ICO recommends carrying out due diligence or audits on third parties involved in hardware destruction and checking whether they maintain asset security throughout the disposal process.

Its guidance also highlights the importance of appropriate contractual provisions, security measures, accountability and audit rights when third parties are used to dispose of personal information.

For procurement and compliance teams, this means chain-of-custody controls are something to examine before approving a provider, not something to think about only after a collection has taken place.

How should assets be protected while awaiting collection?

A good chain of custody is supported by physical security.

Documentation alone cannot compensate for assets being left in an uncontrolled environment.

The NCSC recommends that assets containing potentially sensitive information should not be stored in insecure environments while awaiting the next stage of decommissioning.

The ICO similarly recommends secure storage with restricted access and logs showing devices awaiting destruction and their locations.

In practice, organisations may therefore need to consider:

• who can access the storage area;
• whether assets are clearly segregated from equipment still in use;
• whether individual assets or containers are identified;
• how collections are authorised;
• how discrepancies are handled.

The principle is simple: the asset should remain under controlled responsibility until the next authorised custodian takes possession.

What happens during transport?

Transport is one of the most important transition points because the assets leave the organisation’s direct physical control.

A secure destruction process should therefore make it clear when custody transfers, what equipment is being transferred and who becomes responsible for it.

For higher-risk environments, additional measures such as sealed containers, numbered seals, vehicle security or detailed consignment documentation may be appropriate.

The exact measures required will depend on the organisation’s risk assessment.

What matters is that transport does not become a blind spot between secure on-site storage and secure processing.

If the organisation can document departure but cannot demonstrate what happened until a destruction certificate appears later, the evidential chain is weaker than one that records the intervening handover and receipt stages.

Is chain of custody relevant for on-site data destruction?

Yes, although the process may be shorter.

On-site destruction can reduce the number of custody transfers because assets remain at the customer’s premises until they are processed.

That can be valuable for organisations that want to minimise the period during which intact data-bearing media is transported elsewhere.

However, on-site destruction does not eliminate the need for controls.

The organisation may still need to record:

• which assets were authorised for destruction;
• where they were held beforehand;
• who released them;
• who carried out or witnessed the processing;
• what method was used;
• whether every scheduled asset was completed.

The main difference is that fewer physical movements may need to be documented.

This is one reason on-site and off-site destruction should not automatically be treated as identical from a governance perspective. The final security objective may be the same, but the custody path is different.

How does chain of custody relate to a certificate of destruction?

They are connected, but they are not interchangeable.

A certificate of destruction generally provides evidence relating to the final destruction activity.

Chain of custody describes the controlled journey that brought the assets to that point.

A strong destruction process therefore does not rely solely on the final certificate.

For example, a certificate may state that a batch of drives was destroyed on 15 September. That is useful evidence.

But if there is no supporting documentation showing when the drives left the organisation, who took possession of them or how the batch corresponds to the original collection, the certificate alone may not answer every audit question.

The ICO specifically recommends checking that third-party destruction certificates match the equipment actually sent for destruction.

That reconciliation is much easier when the custody records are clear.

How detailed should chain of custody be?

The level of detail should be proportionate to the risk.

A small batch of low-risk equipment may not require exactly the same controls as hundreds of drives removed from a data centre containing commercially sensitive or personal information.

The NCSC explicitly notes that sensitive or valuable assets may require more stringent and detailed chain-of-custody tracking.

This suggests a risk-based approach rather than a single fixed template.

Compliance teams should consider questions such as:

• How sensitive is the information?
• How many assets are involved?
• How long will intact media remain outside active use?
• Will equipment leave the premises before sanitisation?
• How many parties will handle it?
• What evidence would be needed if an asset later appeared to be missing?
• Are there customer, regulatory or contractual requirements for additional assurance?

The higher the consequence of losing control of an asset, the stronger the argument for detailed custody records.

Frequently Asked Questions

Is chain of custody a specific UK GDPR requirement?

UK GDPR does not prescribe one standard chain-of-custody form for data destruction. However, organisations must implement appropriate security and accountability controls. ICO guidance recommends secure disposal procedures, logs, secure storage, third-party oversight and evidence of destruction, all of which support effective custody management.

Does chain of custody only apply to hard drives?

No. The principle can apply to any asset containing information that needs controlled disposal, including SSDs, magnetic tapes and other storage media. The exact destruction method may differ, but the need to control sensitive assets before processing remains.

Who should sign a chain-of-custody record?

The appropriate people depend on the process. Records may identify the authorised person releasing the assets and the authorised person receiving responsibility for them at each significant handover.

Are serial numbers required for chain of custody?

Not always. Individual serial numbers can strengthen asset-level traceability, but some processes may also use batch, container or consignment identifiers. The appropriate level of detail should reflect the organisation’s risk and assurance requirements.

Can on-site destruction remove chain-of-custody risk completely?

No. It can reduce custody transfers because intact media does not need to travel to an off-site destruction facility, but assets still require secure storage, authorisation, tracking and evidence that the planned destruction was completed.

Maintaining control until the data is no longer a risk

Chain of custody is fundamentally about avoiding uncertainty.

An organisation should be able to explain where sensitive data-bearing assets were held, who was responsible for them, when responsibility changed and how they reached their final destruction or sanitisation stage.

That does not mean every organisation needs an unnecessarily complicated paperwork process.

It does mean that the level of tracking should be strong enough for the risks involved.

For organisations handling significant quantities of sensitive data, a clear chain of custody can help connect internal asset records, secure storage, collection, transport and final destruction into one continuous and auditable process.

Varese Secure provides on-site and off-site secure data destruction, secure collection and certified processing for organisations handling sensitive information across the UK.

Phone: 01489 854 131
Email: sales@varese-secure.co.uk
Find out more: https://varese-secure.co.uk/