Once a drive has been shredded, the certificate of destruction is the only evidence left that it happened. If an auditor, a client or a regulator asks what became of a laptop you retired two years ago, that piece of paper has to answer the question on its own. Many certificates can’t. Here is what yours should contain, and how to check it before you file it.
What the certificate is for
Under UK GDPR, an organisation has to look after personal data securely, keep it no longer than it needs to, and be able to demonstrate that it has done so. When old equipment leaves the business, the certificate is a large part of that demonstration.
What it doesn’t do is hand your responsibility to someone else. If a supplier destroys equipment holding personal data on your behalf, your organisation remains accountable for choosing a suitable supplier and for having a written agreement in place. Treat the certificate as a record of what was done, not as a shield. If you aren’t sure how the rules apply to your organisation, ask your data protection lead or a legal adviser.
What a certificate of destruction should contain
A useful certificate lets someone who wasn’t involved work out exactly what happened. Look for:
- Who carried out the work: the company’s full name and address, and its ICO registration number if it has one.
- Who it was done for: your organisation’s legal name, and the site the equipment came from.
- A unique reference number, so the certificate can be tied to your purchase order, ticket or collection note.
- An itemised list of every device: type, make, model, capacity and serial number, plus your own asset tag if you use them.
- The method used for each item, such as shredding, crushing, degaussing or software erasure.
- The date and place of destruction, including whether it was done at your premises or at the provider’s facility.
- The name and signature of the person responsible, and of any witness if someone from your team watched it happen.
Why the serial numbers matter most
“24 hard drives destroyed” proves very little. It can’t show that the drive from your finance director’s old PC was one of the 24. A list of serial numbers can, which is why itemisation is the first thing to check.
There is a common trap here: the serial number on the outside of a laptop or server is not the serial number of the drive inside it. If your asset register only records the machine, a certificate listing drive serials can’t be matched to it. Two simple habits fix this:
- Record both numbers when the drive is taken out, or ask the provider to list the drive serial alongside the machine it came from.
- For devices where storage can’t be removed, such as phones, tablets and many thin laptops, make sure the certificate lists the device’s own serial number or IMEI instead.
Don’t forget the loose items. Spare drives from old RAID arrays, USB sticks and memory cards rarely appear on an asset register at all, so list them on the handover note, even if only by count and description.
Be precise about the method
“Securely destroyed” is too vague for a record. The wording should make clear which of two very different things took place:
- Physical destruction means the device no longer exists in working form. The certificate should name the process used.
- Software erasure means the device survives and may be reused, so the record matters even more. Expect the software used and a pass or fail result for each drive. A drive that failed erasure should be shown as destroyed by another method, not quietly dropped from the list.
Our data destruction page explains the main methods if you need to decide which one to ask for.
The certificate only covers the end of the journey
A certificate tells you what happened at the moment of destruction. It says nothing about the days before. If equipment leaves your premises, you also want a signed collection note listing what was handed over, when, and to whom. Your record then runs unbroken from your office to the shredder.
If the data is too sensitive to leave the building at all, on-site destruction closes that gap, and your own staff can watch it take place. Our hard drive disposal and recycling service covers both on-site work and collection. The FAQ explains how equipment is kept secure at our facility.
Check it before you file it
Most problems are easy to fix in the week the certificate arrives and impossible to fix two years later. Spend ten minutes on these checks:
- Does the number of items match the collection note?
- Does every serial number match your list? Query any that are missing or unfamiliar.
- Is the destruction date on or after the collection date?
- Are your organisation’s name and the site address correct?
- Is it signed, with a reference number you can quote?
- Have you marked each item as destroyed on your asset register, with the certificate reference beside it?
Warning signs
Be cautious if a certificate gives only a total or a weight, carries no date or signature, or uses a template with blanks left unfilled. Ask questions too if it names a different company from the one you hired: you need to know who actually handled your equipment. A provider should also be able to explain in plain terms how each type of device was dealt with.
How long should you keep it?
There is no single period that applies to every business. Set one in your retention schedule, taking into account any contract terms or sector rules you work under, and keep the certificates alongside your asset register so they can be found quickly. It helps to think about how long someone could reasonably ask what happened to that equipment. Store a digital copy as well, since a paper file is easily lost in an office move.
Need certified destruction in London?
We can provide a certificate of data destruction for all our hard drive disposal services, on-site or at our London facility, and there is no minimum number of drives. Book a collection or call 020 7064 4996 to talk through what you need destroyed.