Certificate of destruction and erasure report: what they must contain

After data erasure or data carrier destruction, one thing above all remains: a document. In an audit, in a data protection inspection, or after an incident, this document is the only proof that your data is really gone. But not every "certificate" lives up to its name. This article shows what a certificate of destruction and an erasure report must contain, how to recognize weak records, and how to file the documents sensibly.

Which records exist

In everyday use, the terms are often mixed up. For clean documentation, it helps to keep them apart:

Document	What it proves	Typical timing
Handover or acceptance record	Which devices and containers were handed to whom and when	At pickup
Erasure report or erasure certificate	That a specific data carrier was successfully erased using a specific method	After erasure, per device or data carrier
Certificate of destruction or destruction report	That data carriers were physically destroyed to a security level	After destruction, per order with a serial number list
Disposal certificate	That devices or residues were recovered properly	After recovery
Audit or final report	The entire order at a glance	At completion

For data protection, the erasure report and the certificate of destruction are the decisive documents. The other records complete the chain from the desk to recycling.

What an erasure report must contain

An erasure report is produced when a data carrier is overwritten with software or erased through the drive's internal commands. A reliable report answers these questions for every data carrier: what, when, how, with what result, and by whom?

• Device identification: Manufacturer, model, serial number, inventory number where applicable.
• Data carrier identification: Type (HDD, SSD, flash), manufacturer, model, serial number, capacity.
• Erasure method: Name of the method or standard, number of passes, verification where applicable.
• Software: Name and version of the erasure software.
• Time and duration: Start, end, date.
• Result: successful or failed, with a note on detected errors or hidden areas (HPA, DCO).
• Performing party: Service provider, site, responsible person or workstation.
• Authenticity: ideally a digital signature, so that the report cannot be altered afterwards.

At Second IT, you receive a digitally signed erasure certificate for every erased device. The Blancco erasure reports contain, among other things, the erasure duration, the erasure algorithm selected, and the number of overwrite passes. The basis is an erasure report per serial number. How erasure works technically is explained in our guide to secure erasure of hard drives and SSDs.

Example: what an entry in an erasure report can look like

Field	Example content
Device	Laptop, manufacturer and model, device serial number
Data carrier	SSD, manufacturer and model, serial number, capacity
Method	Name of the erasure standard or method, number of passes, verification
Software	Product name and version number
Time	Date, start, end, duration
Result	Successful; hidden areas detected and erased
Issuer	Service provider, site, workstation or responsible person
Authenticity	Digital signature

If one of these fields is missing, the report is not worthless. But every gap makes it harder to prove without gaps, if it comes to it, what happened to a particular data carrier.

What a certificate of destruction must contain

A certificate of destruction proves physical destruction. In Germany, the benchmark is DIN 66399, whose third part also describes the data carrier destruction process. A good certificate of destruction contains:

• Client and order number
• Service provider and place of destruction, and for on-site destruction also the vehicle
• Date of destruction
• Type and number of data carriers, for example hard drives, SSDs, tapes
• Serial number list of all destroyed data carriers
• Security level per DIN 66399, for example H-5 for hard drives
• Confirmation of destruction with signature or digital signature of the responsible party
• Note on the recovery of the residues, for example as raw material

Second IT destroys data carriers in-house, under video surveillance and per DIN 66399, certified for security level H-5. Every data carrier is registered with its serial number. At the end there is a certificate of destruction per DIN 66399.

Warning signs of weak records

• Only a quantity or weight figure, no serial numbers.
• No information on the security level or the erasure method.
• No date of the actual destruction, only the pickup date.
• No identifiable issuer or no signature or digital signature.
• Blanket wording such as "was disposed of properly".
• The document comes from a subcontractor you do not know.

What costs arise with destruction and when erasure is cheaper is shown by the comparison cost of hard drive destruction.

What the GDPR and the BSI say about it

The GDPR does not prescribe a form. However, it requires that the controller can demonstrate compliance with the principles – the so-called accountability obligation under Art. 5(2) GDPR. If you engage a service provider, the data processing agreement under Art. 28 GDPR regulates how data is erased after the service is completed and which records you receive.

In the BSI's IT-Grundschutz, module CON.6 "Deleting and Destroying" covers the topic. Among other things, it requires regulated procedures and documentation. For building an erasure concept, there is also the standard DIN 66398. Internationally, NIST SP 800-88 offers a template for an erasure record in its appendix. This article does not replace legal advice.

Special requirements for classified information

Authorities and companies that work with classified information have additional requirements. For VS-NfD data carriers, it is documented especially precisely who handled which device, when, and how. All Second IT employees are bound to data secrecy; more on the commitment to data secrecy. What authorities must observe beyond that is described in our guide to VS-NfD hardware.

Checking and filing records

At Second IT, you can track the status of every device in the customer portal. This makes reconciliation easier because you do not have to wait for a single final report.

A common stumbling block during reconciliation: your inventory list records the device's serial number, while the erasure report records the data carrier's serial number. Make sure the record contains both numbers or that you receive a mapping. Otherwise it is hard to prove afterwards which data carrier was in which device. This applies especially to servers with many drives.

Using records for sustainability reports

Erasure and destruction records are valuable not only for data protection. Together with disposal records, they also show how many devices were reused, how many were recycled, and how many were destroyed. These figures are increasingly needed for sustainability reports and supplier inquiries. An erasure certificate is an indirect proof of reuse: an erased device can continue to be used, a destroyed one cannot.

At Second IT, in addition to erasure and destruction certificates, you also receive audit reports as well as recycling and disposal records for CSR and ESG reports. On request, an annual, individual environmental report is available.

How long should you retain records?

There is no general statutory period specifically for erasure and destruction records. The records serve to fulfill your accountability obligation. Therefore define the retention period in your erasure concept and orient yourself to audit cycles, limitation periods, and industry-specific requirements. Many companies keep the records for several years. Agree on the period with your data protection officer.

How records fit into a regulated decommissioning process is also described in our article on IT Asset Disposition.

More on the topic: Choosing an ITAD provider: 12 questions to avoid common pitfalls and Data gone, value remains: Why certified data erasure is worth its weight in gold.

Frequently asked questions about certificates of destruction and erasure reports

What is a certificate of destruction?

A certificate of destruction is the written proof that data carriers were physically destroyed. It names the client, service provider, date, type and number of data carriers, their serial numbers, and the security level per DIN 66399. It serves as evidence for data protection inspections and audits.

What is the difference between an erasure report and a certificate of destruction?

An erasure report proves that a data carrier was securely overwritten or erased with software. The data carrier remains usable and can be reused. A certificate of destruction proves physical destruction. Both records should list every data carrier by serial number.

Is a destruction record with a weight figure enough?

For reliable documentation, usually not. A weight figure only shows that a quantity was destroyed, but not which data carriers. If it comes to it, you then cannot prove that a particular drive was among them. Therefore demand a list of serial numbers.

Does the GDPR prescribe an erasure report?

The GDPR does not name a specific document. It does, however, oblige you to be able to demonstrate compliance with the data protection principles. An erasure report per serial number is the most practical way to do so. Which records you specifically need, you define in your erasure concept.