What a certificate of data destruction is
The title on the document does not make it a legal form, and it does not prove the work was right for your devices. What matters is what the certificate lists and whether that matches your own policy and contracts.
Some businesses want every drive shredded, others want drives wiped so computers can be reused, and many want a mix. The certificate should describe what actually happened. Have IT approve the method first, and check whether any data must be kept for legal reasons.
What the certificate usually lists
| Item on the certificate | Why it matters |
|---|---|
| Your business name and a job number | Links it to your booking |
| Make and model of each device | Shows what was handled |
| Drive serial number | Shows which drive got which treatment |
| The computer it came from | Lets you tick it off your asset list |
| Type of drive | Shows the method suited the drive |
| Method used: wiped or destroyed | Shows what was done |
| Date and place of the work | Shows when and where it happened |
| Result for each drive | Shows which drives passed and which did not |
| Who did the work and who signed off | Shows who is responsible |
| Anything not finished | Shows what still needs action |
Serial numbers and the computer they came from
One computer can hold more than one drive. The serial number on the case does not identify the drives inside. If your asset list tracks drives, ask for each drive to be linked to its computer.
If a drive has no readable serial number, it should get a clearly marked substitute number. Nobody should make up a serial to fill the gap.
For a large batch, a spreadsheet listing every drive is easier to check than a single cover page.
Different drives need different methods
A spinning hard drive, a solid-state drive and the storage built into a printer or tablet are all different. Do not pick a method from the age or look of the device. Ask IT what storage is inside.
Printers, copiers, network gear and tablets often hold data you cannot see. List the full model so nothing is missed.
Encrypted drives can sometimes be wiped by destroying the encryption keys. That only works if the drive was set up for it, and it is not the same as a factory reset.
For physical data destruction, a photo of a dented case does not prove the storage inside was destroyed. Do not drill or crush drives yourself. You can damage the serial number, and devices with batteries can be dangerous to break.
The OAIC's guidance on securing personal information explains the obligations for organisations covered by the Privacy Act.
When a drive fails or goes missing
If ten computers go out, one with two drives and one with none, the drive count will not match the computer count. That is fine if the list explains it.
If one drive will not wipe, it should be listed as not done, with what happens next. A cover page saying the job is complete should not hide it. If the count on the day differs from your list, sort it out before the truck leaves.
Questions to ask before you book
- Which types of drives and devices are in the job?
- Will each drive be listed, or only the total?
- Which method suits each drive type?
- What happens to a drive that fails or cannot be reached?
- Can you see a sample with private details removed?
Ask these before you book, not after the equipment has gone. Store the paperwork you receive somewhere secure and keep it as long as your records policy says.
What Crex does
Crex collects business IT through e-waste collection. Tell us which devices hold data and how you want them handled, and drives are wiped or destroyed the way you instruct. The rest is recycled.
See hard drives, computers and laptops, printers and copiers and our compliance page. Email your device list to enquiries@crexgroup.com.au, or tell us what you've got.