Approving a data destruction process should involve more than checking whether a supplier promises to “securely destroy” old IT equipment.

Compliance teams need to understand what is being destroyed, which destruction method will be used, how assets remain protected before processing, who is responsible at each stage and what evidence will demonstrate that the process was completed correctly.

This matters because data-bearing equipment can remain a security risk until the information has genuinely been sanitised or the media has been securely destroyed.

The ICO’s data protection audit framework recommends documenting secure disposal procedures, retaining destruction logs and certificates, obtaining management approval before disposal and carrying out due diligence on third parties involved in hardware destruction.

A useful compliance review should therefore assess the whole process rather than concentrating only on the final destruction machine.

1. Has the organisation identified exactly what is being destroyed?

The first question is surprisingly basic:

What assets are actually entering the destruction process?

A process cannot be properly approved if the media involved is not understood.

An organisation may need to dispose of:

• magnetic hard disk drives;
• solid-state drives;
• magnetic backup tapes;
• removable flash storage;
• complete laptops or servers;
• other data-bearing devices.

This distinction matters because different storage technologies can require different sanitisation or destruction methods.

For example, degaussing can be appropriate for compatible magnetic media, but it is not suitable for flash-based SSD storage.

A generic policy stating that “all drives will be securely erased” therefore gives a compliance team too little information.

The proposed process should identify the media involved and explain how each category will be handled.

2. Is the destruction method suitable for the media?

Once the asset types are known, the next question is whether the proposed method is technically appropriate.

Methods may include secure wiping, degaussing or physical destruction, depending on the media, the intended outcome and the level of assurance required.

The ICO specifically identifies wiping, degaussing and secure hardware destruction as potential methods for electronic records, while stressing that organisations should document the disposal methods they use.

NIST’s current SP 800-88 Revision 2 takes a similarly risk-based approach. It defines media sanitisation as rendering access to target information infeasible for a given level of effort and advises organisations to select appropriate controls based on information sensitivity.

Compliance teams should therefore avoid asking only:

“Is this a recognised destruction method?”

The better question is:

“Is this method appropriate for this particular media, information sensitivity and intended outcome?”

A valid method used on the wrong storage technology is still an unsuitable process.

3. Is the required level of destruction clearly defined?

The organisation should also establish what outcome it expects.

There is an important difference between:

• preparing equipment for internal reuse;
• preparing equipment for resale;
• permanently sanitising data;
• physically destroying the storage media.

The correct approach depends partly on what will happen to the asset afterwards.

The NCSC defines sanitisation as treating storage media so that the likelihood of recovering the information is reduced to an acceptable level. Some forms allow the media to be reused, while others permanently destroy it.

This makes the intended endpoint an important part of approval.

If the organisation requires irreversible destruction because a drive contains particularly sensitive information, a process designed primarily to prepare equipment for reuse may not satisfy that requirement.

Conversely, physically destroying reusable equipment may be unnecessary where an approved and suitably assured sanitisation process is sufficient.

The requirement should be decided before the process begins, not after the assets have already been handled.

4. Is there a documented procedure?

A verbal understanding with an IT team or disposal company is not enough for a controlled process.

The organisation should have a documented procedure describing how data-bearing equipment moves from active use to final disposition.

The ICO explicitly recommends documenting procedures for secure disposal and maintaining evidence of management approval and sign-off before hardware assets are disposed of.

A documented procedure might cover:

• who can authorise assets for destruction;
• where devices are stored;
• how equipment is recorded;
• who may access it;
• how the destruction method is selected;
• how collection or internal transfer is controlled;
• what happens if records do not match;
• what evidence is retained after completion.

The exact level of detail will vary between organisations.

What matters is that employees do not have to improvise when sensitive hardware reaches the end of its useful life.

5. Are assets protected while awaiting destruction?

Compliance approval should not focus only on what happens inside a shredder or degausser.

An intact drive may remain readable for days or weeks before destruction.

The security arrangements during that period therefore matter.

The ICO recommends keeping hardware awaiting destruction in a locked area with limited access and maintaining logs showing the devices and their locations.

The NCSC similarly states that assets containing potentially sensitive data should not be kept in insecure environments while awaiting the next stage of decommissioning.

Compliance teams should therefore ask practical questions.

Where will drives be kept once they have been removed from live systems?

Who can enter that area?

Can equipment awaiting destruction be confused with equipment awaiting redeployment?

Is there a record of what is currently being held?

How would the organisation discover that a device had gone missing?

A destruction process with excellent final-stage security but weak pre-destruction storage can still contain a significant vulnerability.

6. Is responsibility clear at every handover?

Where assets move between departments, sites or organisations, responsibility should remain clear.

The NCSC recommends appropriate tracking when assets are transferred between people or teams and notes that particularly sensitive or valuable assets may require detailed chain-of-custody controls.

Compliance teams do not necessarily need to prescribe one universal custody form.

They should, however, be satisfied that the process can answer questions such as:

• Who released the equipment?
• Who received it?
• When did the transfer happen?
• What assets or containers were included?
• Who had responsibility during transport?
• When was the consignment received for processing?

For particularly sensitive environments, those records may need to be detailed.

For lower-risk equipment, a simpler documented handover may be proportionate.

The central requirement is to avoid periods where the organisation cannot account for intact data-bearing assets.

7. Can individual assets or batches be reconciled?

Compliance teams should determine how the organisation will know that everything approved for destruction was actually processed.

The answer may involve serial numbers, internal asset tags, batch identifiers, container numbers or another suitable reference system.

The ICO recommends keeping a destruction log covering hardware assets that are destroyed. It also advises assigning responsibility for checking that third-party destruction certificates correspond with the equipment originally sent for destruction.

This reconciliation stage is important.

Imagine that 250 drives are released for destruction but the final records only account for 249.

A well-designed process should make that discrepancy visible and define what happens next.

A weak process may simply record that “approximately 250 drives” were processed and provide no practical way of identifying the missing asset.

The purpose of traceability is therefore not administrative perfection. It is ensuring that exceptions can be detected and investigated.

8. Has the destruction provider been properly assessed?

Using a specialist provider can add expertise, dedicated equipment and established controls, but compliance teams should not assume that outsourcing automatically transfers all responsibility.

The ICO specifically recommends due diligence or audits of third parties to determine whether they maintain hardware security throughout the disposal process.

It also states that contracts with third parties disposing of personal information should address matters including security measures, accountability and the organisation’s right to audit the provider.

The NCSC similarly recommends making sure third parties carrying out sensitive decommissioning activities are appropriately vetted and certified.

Depending on the organisation and risk involved, a compliance review could therefore consider:

• what destruction methods the provider uses;
• whether those methods suit the organisation’s media;
• how assets are stored and transported;
• how employees or subcontractors are controlled;
• what documentation is produced;
• what certifications or standards are relevant;
• whether subcontracting takes place;
• whether audit rights exist;
• how incidents and discrepancies are handled.

A certificate or accreditation can be useful evidence, but it should not replace understanding the actual service being procured.

9. Does the contract reflect the security requirement?

A commercial agreement should not simply specify a collection date and price.

Where personal or confidential information is involved, the agreement should make the required security outcome clear.

The ICO’s audit guidance specifically identifies appropriate contracts as a control where third parties dispose of personal information. It recommends including suitable security, accountability and audit provisions.

Depending on the arrangement, compliance teams may therefore want the contract or associated service documentation to establish matters such as:

• the agreed destruction or sanitisation method;
• responsibility for assets after collection;
• required evidence;
• security during transport and storage;
• treatment of discrepancies;
• agreed processing times;
• use of subcontractors;
• incident reporting;
• audit or inspection rights.

The aim is to ensure that “secure destruction” has an agreed meaning rather than being an undefined marketing phrase.

10. What evidence will be produced after destruction?

Compliance teams should decide in advance what evidence they will need after the work is completed.

Waiting until an audit to discover that the records are inadequate is too late.

The NCSC recommends retaining evidence where destruction work has been delegated to external parties and notes that this evidence commonly takes the form of certificates. It also advises that internally completed decommissioning activities should be appropriately documented.

The ICO similarly recommends destruction logs and third-party destruction certificates.

Depending on the required assurance level, useful evidence may include:

• destruction certificates;
• individual asset records;
• batch or consignment references;
• dates of processing;
• destruction method;
• quantities processed;
• signatures or approval records;
• exceptions or discrepancies.

Compliance teams should also ask whether the evidence actually connects back to the assets released by the organisation.

A document saying “500 drives destroyed” is less useful if nobody can establish whether those were the same 500 drives listed on the internal asset schedule.

11. Is there a verification step after processing?

Evidence should be reviewed, not merely received.

The NCSC advises organisations to verify that decommissioning has been effective and to retain evidence when third parties carry out destruction activities.

The ICO goes further by recommending that a specific staff member checks whether destruction certificates correspond with what was sent for destruction.

This suggests an important governance principle:

Completion of the physical destruction activity should not automatically equal completion of the compliance process.

Someone should confirm that the expected assets were processed and that the documentation is complete.

If records do not reconcile, the process should define how the difference is escalated and investigated.

12. Are asset registers updated afterwards?

Secure destruction should have an endpoint within the organisation’s own records.

Once hardware has been destroyed, it should no longer appear in asset systems as if it remains operational, in storage or available for reassignment.

The NCSC recommends updating asset inventories following decommissioning so the organisation retains a reliable source of information about its environment.

This is easy to overlook.

A technically flawless destruction process can still leave poor governance behind if internal records continue showing destroyed equipment as active.

Updating the asset register closes that loop.

13. Does the process account for exceptions and failures?

Compliance reviews often concentrate on the normal workflow.

A stronger review also asks what happens when the normal workflow fails.

For example:

• What if one drive is missing?
• What if a serial number cannot be read?
• What if a container seal is damaged?
• What if equipment arrives that cannot be processed by the planned method?
• What if the destruction machine reports an unsuccessful cycle?
• What if the final quantity differs from the collection record?

A credible destruction process should not depend on everything going perfectly.

Exceptions should be isolated, documented and resolved rather than quietly absorbed into a completed batch.

This is particularly important because the quality of a control is often revealed by how it handles abnormalities rather than routine transactions.

A practical approval checklist

Before approving a secure data destruction process, compliance teams should be able to answer yes to questions such as:

• Have the types of data-bearing media been identified?
• Is the proposed sanitisation or destruction method suitable for each type?
• Is the required security outcome clearly defined?
• Is there a documented disposal procedure?
• Are assets stored securely before processing?
• Are transfers and handovers adequately controlled?
• Can assets or batches be reconciled?
• Has any third-party provider undergone appropriate due diligence?
• Do contractual terms reflect the required security controls?
• Will appropriate destruction evidence be supplied?
• Is someone responsible for checking that evidence?
• Will internal asset records be updated afterwards?
• Is there a defined procedure for discrepancies and failed processing?

A “no” does not automatically mean the entire process must be rejected.

It does indicate an area that should be resolved before approval is given.

Frequently Asked Questions

Does UK GDPR specify one approved data destruction method?

No single destruction technique is prescribed for every situation. Organisations need appropriate technical and organisational measures to protect personal information. The ICO recognises approaches including wiping, degaussing and secure hardware destruction, with the appropriate method depending on the circumstances.

Is a certificate of destruction enough for compliance?

Not necessarily by itself. A certificate can provide valuable evidence, but the ICO also recommends secure storage, destruction logs, appropriate third-party contracts, due diligence and reconciliation between certificates and the equipment sent for destruction.

Should compliance teams approve the destruction equipment itself?

They do not necessarily need to become technical specialists, but they should obtain sufficient evidence that the proposed method and equipment are suitable for the media and security requirement involved. Specialist technical input may be appropriate where those questions cannot be answered internally.

Should on-site and off-site destruction be assessed differently?

The same fundamental security outcome may apply, but the operational risks differ. Off-site destruction introduces transport and additional custody stages, while on-site destruction can reduce those movements. The chosen process should account for its actual custody pathway.

How often should an approved process be reviewed?

There is no single universal review interval suitable for every organisation. Reviews should take account of changes to storage technology, suppliers, organisational risks, internal policies and applicable regulatory or contractual requirements. Periodic auditing can also confirm whether the approved process is being followed in practice.

Approval should be based on evidence, not assumptions

A secure data destruction process should be treated as a controlled information-security workflow rather than simply an arrangement for removing unwanted hardware.

Compliance teams need enough evidence to understand the assets involved, the method being used, how equipment remains protected, how responsibility is transferred and how successful destruction will be demonstrated.

The strongest approval process therefore considers the full lifecycle:

identify → authorise → secure → transfer → destroy → verify → reconcile → close the asset record.

If any stage depends on assumptions rather than documented controls, that is the point to investigate before the destruction process is approved.

Varese Secure provides secure data destruction, degaussing, hard drive destruction, secure collection and certified processing for organisations handling sensitive information. On-site and off-site options allow organisations to select a process suited to their security, operational and audit requirements.

Phone: 01489 854 131
Email: sales@varese-secure.co.uk
Find out more: https://varese-secure.co.uk/