When old laptops, servers or phones leave your business, they usually come back as a single piece of paper: a data destruction certificate. It’s meant to prove that the data on them was dealt with. Too often it’s a one-line note saying “50 items destroyed”, which proves very little.
This guide explains what a useful certificate lists, how to check it against your own records, and what to ask a provider before you hand anything over. It applies whoever you use. To talk about your own equipment, see our IT asset disposal and secure data destruction service.
Why the certificate matters
Your organisation is responsible for the personal and business data on its devices, including when they’re disposed of. Under UK GDPR, personal data must be processed in a way that ensures appropriate security, and that doesn’t stop when a laptop leaves the building. The National Cyber Security Centre advises that storage media should be sanitised before a device leaves your organisation’s control. If a device turns up later with readable data on it, the certificate and the records behind it are how you show what happened.
A certificate doesn’t make you compliant on its own. It’s evidence. It’s only as good as the process behind it, and only useful if it matches your own asset register.
What a good certificate lists
Asset-level detail
The single most important thing: each device listed individually.
- Device type (laptop, desktop, server, hard drive, phone, printer).
- Make and model.
- Serial number, and the drive serial number for drives removed from devices.
- Your own asset tag, if you use them.
A certificate that only gives a total count can’t be matched to your records: without serial numbers, nobody can show which device was processed. Ask for the asset list as a spreadsheet as well as the signed certificate.
Printers and photocopiers belong on the list too. The NCSC notes that several gigabytes of sensitive documents have been retrieved from decommissioned ones.
Method used, and to what standard
For each device, or each group, the certificate should say:
- Whether the data was overwritten (wiped), the media degaussed, or the media physically destroyed (shredded or crushed).
- For wiping: the software used and whether each wipe was verified.
- For shredding: the particle size the media was reduced to.
- The standard or guidance the method follows.
Date, place and who did it
- The date of destruction or wiping.
- Where it happened: at your site, or at a processing facility.
- The name of the person or company responsible, and a signature.
- A unique certificate reference.
Wiping versus destroying
Wiping overwrites the data and leaves the device usable. It allows reuse or resale, which is better environmentally and can return value. It only works if the device is working and the wipe is verified: the NCSC’s guidance is to read the whole of the user-accessible memory back afterwards to check it holds the overwrite value.
Degaussing only works on magnetic media. It does nothing to solid state drives.
Physical destruction shreds or crushes the storage media to a defined particle size. It’s used for the most sensitive data, for failed drives that can’t be wiped, and for solid state media where verified erasure isn’t achievable.
Many organisations use both: wipe and reuse what they can, destroy what they must. Your data protection policy should say which applies to which kind of equipment.
Matching it to your asset register
When the certificate arrives:
- Compare its serial numbers with the list of devices you handed over.
- Investigate any device on your list that isn’t on the certificate.
- Check the method for each device matches what you agreed.
- Update your asset register to show each device as disposed of, with the certificate reference.
- File the certificate with your records.
If numbers don’t match, raise it straight away, while the provider still has the paperwork for that collection.
Chain of custody before destruction
The risky moment is often before destruction: when equipment is sitting in a corridor, loaded onto a vehicle or waiting at a depot. Ask your provider:
- How is equipment secured at your site before collection?
- Is it scanned or listed at collection, and do you get a copy?
- How is it transported, and is the vehicle secure?
- How long between collection and destruction, and where is it held?
- Who processes it, and where does it go after the first facility?
If the risk is high, ask whether wiping or destruction can be done at your site. If you need on-site witnessed destruction, tell us before you shortlist and we’ll confirm whether we can meet that requirement for your project.
If a provider will be handling personal data on your behalf, UK GDPR says that work must be governed by a contract, in writing. The Information Commissioner’s Office says you must choose a processor that gives sufficient guarantees about its security measures.
Standards buyers ask about
You’ll see several standards and schemes mentioned:
- NIST SP 800-88: US guidance on media sanitisation, widely quoted in the UK. The current version is Revision 2, published in September 2025, which replaced Revision 1 from 2014. Check which one a provider means.
- BS EN 15713:2023: the code of practice for secure physical destruction of confidential and sensitive material, whether on site with mobile equipment or at a destruction facility. It doesn’t cover erasure.
- ADISA: a certification scheme covering IT asset disposal and data sanitisation, with a public search for certified companies.
- NCSC schemes: the NCSC’s CAS-S sanitisation scheme closed on 5 January 2026. Existing CAS-S certificates stay valid until they expire, and the NCSC has launched Sanitisation Service Assurance in its place.
- HMG IS5: an older UK government sanitisation standard that still appears on some certificates and contracts. The NCSC’s current public guidance on sanitising storage media doesn’t refer to it. If a provider quotes IS5, ask what it actually does and which current guidance it follows.
The NCSC suggests asking whether a disposal company holds recognised certifications or works to recognised standards. Ask which standard each method follows, and ask to see any certification the provider claims. A logo on a website isn’t proof.
How we handle it
We collect redundant IT, audit it at serial level and coordinate its processing through certified routes, and we return the documentation. We don’t operate a data destruction facility ourselves. Equipment with remaining life is refurbished for reuse before recycling is considered. Verified erasure produces a per-device certificate against the serial number, not a blanket certificate for a collection. If your procurement documents name specific accreditations, ask us before you shortlist and we’ll confirm whether we can meet them.
Red flags
- A certificate with a total count but no serial numbers.
- No statement of method.
- No date or place of destruction.
- Equipment collected without a signed list.
- Reluctance to say where equipment is processed.
- Certifications claimed but not shown.
What to keep, and for how long
Keep the certificate, the asset list and the collection paperwork with your data protection records. Set how long in your own records retention policy, taking account of any rules in your sector. Keep them at least as long as you’d want to be able to answer a question about that equipment.
Decommissioning more than IT?
If the equipment is leaving because an office is closing, the certificate is one part of a bigger set of records. See our office decommissioning checklist, and our guide to protecting patient data during a healthcare relocation.
To arrange collection, wiping or destruction, see IT asset disposal or contact Continuum Green.
Frequently asked questions
What should a data destruction certificate include?
Each device by type and serial number, the method used and the standard it follows, the date and place, who did it, and a unique reference.
Is a bulk certificate enough?
Not on its own. Without serial numbers you can’t match it to your asset register or show which device was processed. Ask for the itemised list as well.
How long should we keep destruction certificates?
For as long as your records retention policy says, taking account of any rules in your sector. Keep them with your asset register so you can answer questions about any device later.
Last reviewed: 23 October 2026.