What is a certificate of data destruction?
A certificate of data destruction is a formal document from your disposal vendor confirming that the data on specific devices was destroyed: which devices, how, and when. It's the record you'll reach for during an audit, a compliance review, a cyber-insurance questionnaire or a legal dispute.
Why it matters
Several laws require organizations to dispose of sensitive information properly, including:
- HIPAA for protected health information in healthcare
- FERPA for student education records
- GLBA for customer financial information at financial institutions
- The FACTA Disposal Rule for consumer report information
These rules focus on doing disposal properly. Documentation is how you show you did. If a data incident is ever traced back to a retired device, the certificate is one of the first things you'll be asked for.
What a good certificate includes
Use this checklist the next time you receive one:
- Your organization's name and where the equipment came from
- The vendor's name and contact information
- A unique certificate or job number so it can be referenced later
- Dates of pickup and of destruction
- An itemized list of devices, ideally with each drive's serial number
- The method used for each device, such as software wiping or physical destruction
- Verification confirming the wipe was checked and passed
- The standard followed, such as NIST SP 800-88
- The name of the person responsible, with a signature
- Chain-of-custody details describing how the equipment was transferred
Serialized vs. non-serialized certificates
| Type | What it covers | Best for |
|---|---|---|
| Serialized | Every drive listed by serial number | Compliance-sensitive jobs, audits, healthcare and finance |
| Non-serialized | A batch of media confirmed destroyed, without individual serials | Loose drives, tapes, flash media and discs |
If you'll ever need to prove what happened to a specific laptop or server, ask for serialized reporting before the job starts.
Red flags
- No serial numbers on a job where you needed them
- A generic "recycling receipt" that never mentions data
- No method or standard listed
- Vague or missing dates, or a certificate dated before pickup
- A vendor who can't explain what happens to your drives
How long to keep certificates
There isn't one rule for everyone. Many organizations keep certificates for at least six years, which lines up with HIPAA's documentation retention requirement. Your industry, contracts or cyber-insurance policy may require longer. When in doubt, check with your compliance advisor.
Whatever the timeline, store certificates digitally alongside your IT asset records so they're easy to find when someone asks.
Certificates from iRecycleKC
Every business job includes a Certificate of Data Destruction. Wiped drives are documented individually by serial number, along with the method used. Physical destruction is available on request, and a Certificate of Recycling covers the rest of your equipment.
Want to see what ours look like? Ask for a sample when you request a quote.
Planning a bigger cleanout? Read our step-by-step checklist for disposing of company computers.
Asencio Renteria-vigil is COO of iRecycleKC, a Kansas City IT asset disposition and electronics recycling company with 19+ years in the industry.