Corporate DNA on hard disks: a data protection thriller

Introduction: The forgotten risk in your IT

Every company carries its DNA within it - not only in the form of strategies and cultures, but also on its hard drives. From confidential customer data and sensitive business plans to communication histories that are not intended for the public: Old hardware can become a real security risk. But what happens if these digital traces fall into the wrong hands?

A spectacular case from the IT industry shows how a simple mistake in data deletion turned into a data protection scandal - and why your IT deserves more attention than you think.

1. The digital DNA: more than just data

Hard disks store more than just facts and figures. They are the key to corporate values and identities. One example: a medium-sized company from the financial sector had resold old laptops without first deleting them in accordance with BSI regulations. The consequences? An ex-employee used the recovered data to influence negotiations with competitors.

Why does this happen? Many people underestimate the effort required to irretrievably delete data. Simple formatting is not enough - the digital traces remain.

Tip: To ensure that your data cannot be recovered, certified data erasure services should be used. (👉 More about BSI-compliant data erasure experienced).

2. What happens to your hard drives when they are resold?

Remarketing old IT hardware is economical and sustainable - but only if it is done securely. Without professional erasure, old devices often end up in unofficial channels or are resold on online marketplaces. Hobby hackers and criminals can use tools there to restore freely accessible data.

The nightmare:

• Access to sensitive project data.
• Disclosure of customer data - a clear violation of the GDPR.
• Damage to reputation and legal consequences.

Solution: Companies that sell used IT hardware should rely on professional partners who guarantee certified processes.

3. Prevention: the art of proper data erasure

How do you protect yourself from a data protection thriller? The answer lies in clear processes and the right technology:

1. Delete certified hard disks: Methods such as full overwriting with certified software or – in the case of defective data media – physical destruction in accordance with DIN 66399 render data permanently unreadable. In the case of SSDs, simple overwriting is not sufficient; here the manufacturer’s erase commands are used, which certified software such as Blancco automatically uses.
2. Audit and documentation: Have proof of every deletion so that you are legally protected in the event of an emergency.
3. Lifecycle management: Integrate data erasure as an integral part of your IT lifecycle.

4. A look into the future: data protection in a digital world

As digitalization and new technologies increase, so do the risks. Cybercrime is becoming more sophisticated and data protection expectations are becoming stricter. Proactive data management is therefore not only a legal necessity, but also a competitive advantage. Companies that handle their IT responsibly gain the trust of customers and partners.

5. Not an isolated case: what can go wrong with retired data carriers

Documented cases show that old hard drives are a real risk:

• Fines in the millions: In 2022, the US Securities and Exchange Commission (SEC) imposed a $35 million fine on Morgan Stanley for the continued sale of discarded hard drives and servers containing customer data without proper deletion.
• Data on used drives: In a sample of drives purchased on eBay, Blancco and Ontrack found 42 % still sensitive data.

Both examples show: The risk is rarely in the technology itself, but in missing processes and documentation.

6. Checklist for GDPR-compliant retirement of hard drives

1. Maintain inventory: Capture every hard drive and device with a serial number.
2. Signing a contract: Agree on a contract for order processing with the service provider in accordance with Art. 28 GDPR.
3. Safe transportation: Plumbed, GPS-tracked, no intermediate storage (Security logistics).
4. Delete with proof: Certified software, erasure certificate per serial number.
5. Destroy what is not erasable: According to DIN 66399 – at Second IT in-house in Level H-5 (Data carrier destruction).
6. Archiving evidence: The GDPR requires that you can demonstrate compliance (accountability).

You can see which standards and certificates Second IT has met on our page. Certificates.

Do not forget the hard drive in the copier: many multifunction devices store scans, address books and credentials.

Conclusion: Protect data - and think ahead

Your hard disks are more than just technology. They are the digital fingerprint of your company. To avoid data protection nightmares, you need clearly defined processes, modern technologies and cooperation with reliable partners.

If you want to know how to safely recycle used IT hardware while ensuring data protection, now is the time to rethink your strategy.

More on the topic: Disposing of data carriers in accordance with the GDPR: What really matters in an audit and DIN 66399: Which safety level your hard drives need.

Frequently asked questions about hard drives and data protection

What does the GDPR require when sampling hard drives?

The GDPR requires that personal data be deleted as soon as it is no longer needed, and that this is done using appropriate technical measures. It does not prescribe a specific procedure. However, you must be able to prove that the data cannot be restored. In practice, this means certified deletion or destruction, documented for each data carrier.

Delete or destroy – which is safer?

Both methods are safe when they are carried out correctly and documented. Certified deletion has the advantage that the device can be reused and sold. Physical destruction is necessary for defective or unerasable data carriers. Many companies combine both: deleting what works and destroying what is defective.

Do I need an order processing agreement with the service provider?

As a rule, yes. The service provider receives data carriers containing personal data and processes them on your behalf by deleting or destroying them. Article 28 of the GDPR requires a contract for data processing for this purpose. Be sure to ensure that the contract covers transport, deletion procedures, and documentation.