Skip to content 
Löschzertifikat
"The data was erased" – this sentence alone convinces neither a supervisory authority nor an auditor. What is needed is a document that can be assigned to a specific device. That is exactly what an erasure certificate is. Here you will learn what it contains and how it differs from the erasure report.
In brief
An erasure certificate is proof that confirms that the data on a specific data carrier or device was erased using a named method. It states at least the serial number, method, time and result and is ideally digitally signed so that it cannot be altered unnoticed. In IT decommissioning, it serves as evidence of accountability under the GDPR.
What is in an erasure certificate?
There is no legally prescribed form. The following details have proven their worth, which can also be found in the sample certificate of the US guideline NIST SP 800-88 :
| Item | Why it matters |
|---|---|
| Manufacturer, model, serial number of the data carrier or device | Unique assignment to your inventory |
| Erasure method or erasure standard | Shows whether the method suits the data carrier |
| Software used and version | Traceability of the tool |
| Start, end and duration | Proof of timing |
| Result and verification | Proves that the erasure was complete and error-free |
| Performing entity, where applicable person | Accountability |
| Digital signature or signature | Protection against subsequent alteration |
A certificate that only states a quantity or a weight is of little help for assigning individual devices. Which additional details a certificate of destruction needs is shown in our guide Certificate of destruction and erasure report.
Erasure certificate or erasure report?
The terms are often used interchangeably. A sensible distinction: the Erasure report is the technical record of the erasure process as generated by the software, with all details, such as sectors, errors and passes. The erasure certificate is the confirmed, signed or digitally signed summary that you file as proof. In many cases, both are combined in one document.
The certificate of destruction must also be distinguished. It does not prove the erasure, but the physical destruction of a data carrier, for example according to DIN 66399.
Rule of thumb: an erasure certificate without a serial number is a receipt, not proof.
How to recognize a good erasure certificate
- One certificate per device or data carrier, not a collective receipt.
- The serial number matches your device list.
- The method suits the technology, for example a suitable method for SSDs instead of mere overwriting.
- The result is unambiguous, with Erasure verification and a note on errors.
- The document is protected against alteration and can still be retrieved years later.
Erasure certificates at Second IT
Second IT erases with Blancco software and is a Blancco ITAD Gold Partner. After every erasure process, you receive a digitally signed erasure certificate for each individual device. The report contains, among other things, erasure duration, selected erasure algorithm and number of overwrites. Hidden areas such as HPA and DCO are detected and erased. You can track all devices and their status in the customer portal. More about certified data deletion.
Frequently asked questions about the erasure certificate
Is an erasure certificate required by law?
No law prescribes a document with this name. However, the GDPR requires that you can demonstrate compliance with the principles (Art. 5(2) GDPR). An erasure certificate per device is the usual proof that data on decommissioned IT has been removed.
How long should I keep erasure certificates?
The GDPR does not specify a fixed period. Keep the certificates for as long as inquiries from authorities, auditors or data subjects are possible, and define the period in your erasure policy.
Do I also get an erasure certificate for smartphones?
Yes, if erasure is carried out with suitable software. For smartphones and tablets there are special erasure solutions that likewise generate a certificate per device with IMEI or serial number.
What is the difference between an erasure certificate and a certificate of destruction?
The erasure certificate confirms that the data on a data carrier was erased using a named method. The certificate of destruction, by contrast, proves the physical destruction of a data carrier, for example according to DIN 66399.
Is a collective certificate with a quantity enough as proof?
No. A certificate that only states a quantity or a weight cannot be assigned to an individual device. A certificate per device whose serial number matches your device list makes sense.
Digitally signed erasure certificate for every single device.
Send us your device list. You will receive your offer in 48 hours on average.