What should a certificate of destruction list, and why isn't a factory reset enough?
In short: A certificate of destruction should identify each device by serial number, say what method was used, when, by whom and who witnessed it, give the verification result and tie back to a collection record. A factory reset gives you none of that: it does not show the data is unrecoverable, and ASD's guidance sets out specific methods for sanitising or destroying media, including destroying media that cannot be sanitised.
Last checked against the sources listed below. By oowl. General information for Australian small businesses, not legal advice or advice for any particular organisation. Related service: Secure data destruction.
What a certificate of destruction should list
There is no single legal template for businesses, so judge a certificate by whether it would convince an auditor, an insurer or a customer asking what happened to their data. A useful certificate records, for every asset (not one line for a whole pallet):
- a certificate number and the date of the work;
- who owned the asset, and who did the work, with the name of the operator and of any witness;
- make, model and serial number of the device and of each drive or other storage inside it;
- the method used: overwritten, cryptographically erased, or physically destroyed (shredded, crushed or similar), and the tool or equipment;
- the standard followed, with its edition, for example ASD's Information Security Manual guidelines for media;
- the verification result, for example that a read-back after overwriting passed, or that a drive could not be sanitised and was destroyed instead;
- a reference to the collection or chain-of-custody record, so the count handed over matches the count destroyed;
- what happened to the hardware afterwards (resold, recycled, scrapped);
- who issued it, and whether that provider holds any accreditation. A certificate is a record of work done; it is not itself a certification.
For comparison, the ISM requires destruction to be supervised and, for accountable government material, supervision by two cleared people who sign a destruction certificate afterwards. The ISM is written for government, but it is the most useful Australian benchmark for what "properly done" looks like.
Why a factory reset isn't enough
A reset returns a device to its settings. It does not, by itself, show that the data on the storage can no longer be recovered, and it leaves you with no record of what was done. The ISM's media sanitisation guidance is specific about what proper sanitisation involves:
- Magnetic hard drives are overwritten in their entirety at least once with a random pattern, followed by a read back to verify. Hidden areas (the host-protected area and device configuration overlay) must be reset first, and the ATA secure erase command is used as well so that sectors the drive has quietly remapped are overwritten too.
- Flash memory media, which includes SSDs and USB sticks, must be overwritten at least twice and read back, because wear levelling spreads writes across memory blocks.
- Media that cannot be successfully sanitised, for example a faulty or damaged drive, must be destroyed before disposal.
Some modern phones and laptops encrypt their storage, and a reset can discard the key, which is a recognised technique. Even then, a reset screen gives you no verification and nothing to show anyone later. Use a method you can name, check the result, and keep the record.
Why it matters for privacy law
If the Privacy Act applies to you, Australian Privacy Principle 11.2 requires reasonable steps to destroy or de-identify personal information you no longer need (see the APPs). Check whether you must keep the records for another reason first. For example, some AML/CTF customer records have retention periods, which is why disposal should be a review and not a bulk delete. Whether the Act applies to you is covered in Does the Privacy Act apply to my small business?
Questions to ask any provider
- Do you issue one certificate per asset, with serial numbers?
- Which method do you use for each media type, and which standard do you follow?
- What happens if a drive will not sanitise?
- Who witnesses the work, and can I attend or see photos?
- What accreditation do you hold, and what do you not hold?
Our secure data destruction page describes how oowl does this and what its certificates are and are not. oowl holds no destruction accreditation; if your contract requires a certified provider, you need one. This is general information, not legal advice.
Sources
- Information security manual: guidelines for media, Australian Signals Directorate
- Australian Privacy Principles (APP 11), Office of the Australian Information Commissioner
- Privacy Act 1988, Federal Register of Legislation
oowl writes each guide in its own words from these public sources and rechecks them before changing the date above. Guidance changes, so check the sources for the latest detail. Related guides: Does the Privacy Act apply to my small business?; The first 30 days after a data breach under the NDB scheme. All guides: oowl guides.
Common questions
Is a certificate of destruction a legal requirement?
Not generally for an ordinary business as a single rule. But if the Privacy Act applies to you, you must take reasonable steps to destroy or de-identify personal information you no longer need, and a certificate is how you evidence it. Contracts, insurers and some regulators may also ask for one.
Is formatting a drive or deleting files enough?
No. Deleting files and formatting generally leave the underlying data in place. ASD's guidance describes overwriting, with verification, or destruction.
What if the drive is broken?
The ISM says media that cannot be successfully sanitised should be destroyed before disposal. The certificate should say it was destroyed and how.
Can I just physically smash an old laptop myself?
Hitting a laptop is not a reliable way to destroy a drive, and it leaves no evidence. The ISM lists approved destruction methods, such as incinerators, hammer mills, disintegrators and degaussers for magnetic disks. A provider with the right equipment can do it and document it.
Does an oowl certificate count as a certification?
No. oowl holds no accreditation for destruction services. Its certificate is a record of work performed and evidenced.
Want a second pair of eyes?
The free security check is a passive look at what your business already exposes to the internet, read from public records only, with a one-page result in plain English.