Data destruction: Learn what it is and how it works

In 2024, the world is on track to collect 147 zettabytes of data, which is around 147 billion terabytes.

What does this tell us? Today's world is digital. Businesses must adapt as our world continually changes. This digitization creates unique opportunities but also brings its own set of challenges.  

One such challenge is the looming threat of cyber-attacks and data breaches. As businesses operate online and transition to cloud storage, the complexity of the data they store, manage, and dispose of exponentially increases their cyber risk. 

RecordPoint has been helping highly regulated global businesses securely handle their data for over 15 years. In that time, we’ve witnessed the transformative power an effective data destruction strategy can offer.

Companies that aren't prepared to deal with data at scale open themselves to attacks from malicious individuals. With this in mind, it's no surprise that there were 20 percent more US data breaches in the first nine months of 2023 (source) than in any prior year.  

This is why data destruction is so important, as it not only safeguards businesses' data but also helps them remain compliant. Now, let’s explore what data destruction is and the best methods while also going over some common industry terms.

‍

What is data destruction?

Data destruction is the process of destroying data stored so that electronic devices cannot read it. This could be stored on devices like floppy disks, hard drives, cassette tapes, videos, etc.

Making data completely inaccessible is the key here. While deleting random data from your recycle bin may prevent you from accessing it, that doesn't mean the information doesn't exist.

If the data exists, malicious individuals could find a way to recover it. 

Data destruction solves this problem by providing a way for businesses to dispose of their critical data securely. It eliminates all traces of information left on a device, meaning it is no longer accessible.

‍

Why do I need to destroy my data?

Data is essential for businesses. But with enormous amounts of data come enormous responsibilities.

In the first half of 2022, around 236.1 million ransomware attacks occurred globally, costing businesses an average of $4.35 million per breach. Criminals are prepared to exploit companies that don’t manage their data correctly. Knowing how to dispose of unused information properly is crucial to preventing your data from falling into the wrong hands.

Because the threat of a data breach is so high, several legislations exist to ensure businesses handle their data correctly. For example, the NIST SP 800:88 standard specifies three sanitization techniques businesses should utilize to erase data: 

• Clear. 
• Purge. 
• Destroy.

Knowing how to dispose of data properly is more than a matter of good practice. It's an essential way to safeguard your business from unauthorized access, data breaches, and the devastating consequences that follow.

Regulatory compliance standards are more than just guidelines. 

When business owners fail to prove they've handled bulk data destruction correctly, they risk their reputation, subject their company to fines, and face serious legal repercussions if a breach occurs.

‍

‍

What’s the difference between data destruction and data disposal?

Data disposal is an essential part of your records management processes, but the process does little to protect businesses from malicious attacks. Even though the data isn't visible to you, it still exists in some form. This means the information is still recoverable by malicious individuals who know how to find it.

Data disposal is the process many people think of when they imagine secure data destruction. It involves removing data from a device directly, such as during file deletion or when removing applications from a ‘recycle bin.’

Data destruction addresses this problem by removing every data trace from a digital device. This means cybercriminals will have no opportunities to recover and access the data because it simply won't exist or will be encrypted to the point that it is illegible.

‍

What are the best data destruction methods?

There is no one-size-fits-all approach to complete data destruction. Whether it's hard drive erasure, wiping methods for magnetic tapes, or cryptographic erasure for solid-state drives. 

The right approach for you will depend on your storage device and the data you need to destroy. Now, let’s explore the best data destruction types:

1. Wiping

A data wipe involves erasing data from a device so no one can access it. This is usually achieved by connecting the device to data destruction software. 

‍Suitable for:  

• Hard drives.
• SSDs (with a specialized data wiper).

While data wiping is an excellent option for businesses looking to keep their device for future use, it is time-consuming, typically taking many hours to complete for each storage device.

2. Overwriting

Overwriting is a secure data erasure technology that completely wipes a hard drive or other digital storage device by overriding the data with unreadable characters (typically ones and zeroes).

‍Suitable for:

• Hard drives.
• Magnetic tapes.
• SSDs (with specialist overwriting software).  

In most cases, overwriting a device once will be more than enough to remove all the data. When handling classified information, experts may overwrite data storage devices several times to eliminate residual data, known as ‘bit shadows.’  

Overwriting is one of the most effective ways to make data completely unretrievable, but it is time-consuming, often requiring several hours per device.

3. Degaussing

Degaussing involves demagnetizing storage media to eradicate all data. This erases data and renders the device completely unusable, making degaussing one of the most secure data destruction methods.  

Suitable for:  

• Hard drives.
• Magnetic tapes.  

Hard drive degaussing is a much faster data destruction method than overwriting, but it comes with its own set of drawbacks. For example, as degaussing makes the hard drive unusable, it can't be resold or repurposed. 

An unusable hard drive also means checking how much data you've managed to erase is impossible. Though it is possible to detect residual data using an electron microscope, this is extremely costly, making checking for bit shadows challenging for most businesses.

4. Cryptographic erasure

Cryptographic erasure is a highly advanced, secure data destruction method that encrypts information stored on a digital device by permanently destroying the encryption keys.

‍Suitable for:  

• Self-encrypting hard disk drives.
• Self-encrypting solid-state drives (SSDs).  

It works by replacing the Media Encryption Key of a self-encrypting device. While the data remains on the storage device, destroying the key means the data is impossible to decrypt, making it unrecoverable.  

Cryptographic erasure is much faster than overwriting, but it requires a level of knowledge to carry out. Human error and broken keys may limit the success of the method.

5. Physical destruction

Physical destruction is the process of destroying your electronic devices using brute force to leave the data unrecoverable. For example, you may choose to incinerate, drill, or melt your device.  

Suitable for:  

• Any device.  

While physical destruction is one of the most cost-effective methods for erasing data, it isn’t always the most secure, especially for businesses that regularly handle sensitive data.   

Most physical destruction methods leave at least part of the hard drive intact, meaning malicious individuals can still retrieve data using forensics.   

In addition, it goes without saying that any physical damage, such as physical hard drive destruction, will leave your device completely unusable, meaning you can't resell or reuse the asset later. 

6. Shredding

Shredding is another physical destruction method that involves using an industrial shredding machine to destroy devices. It's widely considered one of the most secure, easy ways to destroy data when a device ends its life.  

Suitable for:  

• Any device.  

For example, hard drive shredding involves shredding entire hard drives into tiny pieces, typically no larger than 2 millimeters. This makes the method a top choice for companies that work in high-security environments.  

SSDs are much smaller than other devices, requiring specialized shredding equipment.

‍

‍

Businesses need to go beyond data destruction

Data destruction is vital, but to remain on the right side of compliance, businesses need to prove that they’re destroying their data following proper procedures. This is known as data sanitization.   

In short, data sanitization takes the destruction of data one step further by enforcing recognized verification methods. The process also produces a certified data destruction report that proves the device has been sanitized effectively.

‍

Data sanitization and compliance

Practicing proper data destruction is one thing. Proving that you're sanitizing your data properly is quite another. To do so, you'll need a Certificate of Data Destruction (often called a Certificate of Erasure) stating that you destroyed your media in line with compliance standards.

Your Certificate of Data Destruction should contain detailed information about the devices you've destroyed and how you destroyed them. Think of it as a helpful record that you can use to prove you're handling your data in line with various laws and legislation, such as the NIST 800-88 standard. 

Maintaining and safely storing your data destruction certificates and supporting documentation is crucial, as you'll need to provide them during an audit or chain of custody verification. 

In the worst-case scenario, you'll also need your certified destruction certificates handy during disaster recovery, as this proves a cyber attack wasn't the result of negligent data handling practices.

In all cases, the best way to stay on the right side of compliance is to partner with a records management provider to handle data destruction on your behalf. 

At RecordPoint, we help businesses manage their critical data throughout its lifecycle. We’ll take care of data destruction and maintain certificates on your behalf, so you’re always ready to prove compliance when necessary.

‍

Why does every business need a data destruction policy?

Destroying and sanitizing data is a challenging but increasingly necessary part of a business's operation. And, with companies collecting more data than ever, a cohesive strategy for disposal and destruction is vital.   

The solution lies in a comprehensive data destruction policy that unifies every employee and procedure to create an internal system and process for data management.   

Think of a data destruction policy as a written record of your business's methodologies, strategies, and ideas about data disposal. To elaborate on why this is crucial, here are three benefits a data destruction policy can offer your business.  

• Compliance: Data protection laws and data destruction standards enforce strict regulations surrounding how your business handles consumer data. Having an adequate policy in place can prove that your company is destroying data in a standardized way, helping you stay on the right side of compliance.    

• Security: Having a cohesive policy ensures everyone is on the same page at all times, making it less likely your team will put data at risk through a lack of understanding about best practices.  

• Accountability: A data destruction policy outlines the chain of custody in relation to your storage technology. This makes it easier to determine accountability, outline responsibilities, and discover shortcomings in your data destruction processes. 

‍

Data destruction best practices

Data destruction is incredibly complex, and it's essential to implement the best practices and dispose of data correctly. Here are some industry best practices to follow:

1. Practice data minimization

One of the biggest challenges for businesses looking to implement a data destruction policy is the vast, often overwhelming, amount of data they handle daily. Practicing data minimization helps to alleviate this problem.  

Data minimization is a concept, present in regulations such as the General Data Protection Regulation (GDPR), that in part involves collecting the minimum amount of personal data you need to deliver your service. Adopting a data minimization policy reduces risk and streamlines your operational efficiency by allowing you to focus solely on disposing of essential and relevant data. 

2. Wipe devices before transferring custody

Completely wipe every device before you sell, exchange, or dispose of them. For example, you should always override or wipe a hard drive before you send it to a third-party shredding operation. This prevents issues with your chain of custody further down the line. 

3. Create internal data handling policies

Foster a culture of awareness among your leadership team, IT employees, and staff regarding best practices for enterprise data destruction. Whether through rules, procedures, or courses, training your employees to understand your data destruction policies ensures no weak links to keeping your data secure.

‍

How can RecordPoint help?

For over 15 years, we’ve been helping businesses locate, manage, and control their data.

RecordPoint offers an easier way to locate and manage your data at scale. Our cloud-native platform connects with over 900 applications, allowing you to access and control data from your applications and file shares in one central place.   

Regarding security and privacy, our organizational and technical controls help you keep your data safe and managed in line with privacy regulations, and your workflow streamlined.

When your data reaches the end of its lifecycle, we’ll safely and securely destroy it in line with compliance standards such as NIST-800-88.

Then, we’ll create and maintain a certificate of destruction on your behalf so you can rest easy knowing you’re always ready to prove your compliance with complete confidence when required.

Get in touch with our support team today to learn how RecordPoint can support your business's data needs.