Certified Data Sanitization - Every Device, Every Serial Number
Data on retired hardware does not disappear on its own.
Retired IT assets must be sanitized before reuse, resale, recycling, or disposal.
EPOKA processes every data-bearing device using NIST SP 800-88 Rev. 2 compliant methods providing asset-level documentation and certificates to support security and compliance requirements.
Software erasure is used when assets have resale value, physical destruction when they do not.
A Certificate of Data Destruction is issued per device, per serial number, as standard.
What Is Data Sanitization in ITAD?
Data sanitization in ITAD is the certified process of rendering data on retired IT equipment permanently irrecoverable.
It follows NIST SP 800-88r2 guidelines and uses three methods - Clear, Purge, and Destroy - applied based on media type and data sensitivity.
A Certificate of Data Destruction documents the method used and serves as regulatory compliance evidence.
Data does not disappear when a server is powered off.
A hard drive, SSD, or tape library that leaves your custody without certified sanitization is a data breach waiting to happen.
GDPR Article 17 requires that personal data be rendered permanently unrecoverable - not just deleted, not just reformatted, but irreversibly destroyed with documented proof.
Our data sanitization service is the third step in the ITAD process - it begins the moment assets arrive from secure collection, and it enables the fourth step: remarketing and value recovery. Assets that can be erased retain resale value. Assets that require physical destruction do not - which is why method selection matters.
Key principle: Certified data erasure preserves hardware value. Physical destruction eliminates it. EPOKA uses the least destructive method that satisfies the required security level - maximising your financial return from the buyback valuation.
What “Deleted” Actually Means
Studies of used drives purchased on secondary markets have consistently found recoverable sensitive data on devices that were simply deleted or reformatted. “Deleted” files, reformatted drives, and factory resets do not meet GDPR or NIST standards. Only certified sanitization does.
NIST SP 800-88r2 defines three levels of media sanitization.
The correct method depends on media type, data classification, and whether the asset will be reused, resold, or discarded.
We select the appropriate method per device during triage.
NIST SP 800-88 Rev. 2
NIST released updated guidance in 2025.
EPOKA monitors and aligns with current standards.
Logical overwrite techniques that protect against simple, non-invasive data recovery attempts. Applies to assets that will remain within a trusted operational environment.
Best suited for
Assets being redeployed internally. Low-sensitivity data.
Devices remaining within organisational control.
Cryptographic erase, manufacturer Secure Erase commands, or degaussing.
Protects against laboratory-level recovery.
Required for assets leaving organisational control - including ITAD resale.
Best suited for
Assets for resale or remarketing. SSDs and NVMe drives.
Standard enterprise ITAD where devices leave premises. GDPR compliance default.
Physical shredding, disintegration, or incineration. The device is rendered permanently unusable. Applied where Purge cannot be verified, or data sensitivity demands absolute assurance.
Best suited for
Highest-classification data. Drives that cannot be verified as fully erasable.
Assets where resale value is zero or irrelevant.
| Media Type | Common Examples | Recommended Method | Notes |
|---|---|---|---|
| HDD (Magnetic) | SAS, SATA, SCSI hard drives in servers and storage arrays | Purge | Overwrite (Clear) acceptable for low sensitivity; Purge recommended for all ITAD resale scenarios |
| SSD (NAND Flash) | SATA SSD, PCIe SSD, enterprise flash in laptops and servers | Purge | Standard overwrite insufficient due to wear-levelling. Cryptographic erase or Secure Erase required. |
| NVMe | NVMe M.2, U.2, PCIe in servers, workstations, storage | Purge | Manufacturer Secure Erase or cryptographic erase per IEEE 2883 / NIST Rev. 2 guidance. Physical destruction if SE not supported. |
| Mobile Devices | Smartphones, tablets, mobile workstations | Purge | Cryptographic erase via factory reset with verified key destruction. Certified mobile erasure for enterprise devices. |
| Tape Media | LTO, DLT, DAT tape libraries and cartridges | Destroy | Degaussing or physical shredding. Software-based overwrite not reliable across all tape formats. |
| Optical Media | CD, DVD, Blu-ray, optical storage arrays | Destroy | Physical shredding is the only reliable method. No software sanitization standard applicable. |
| Flash / Removable | USB drives, SD cards, CF cards, memory sticks | Purge / Destroy | Cryptographic erase preferred for devices supporting it. Physical destruction for others or high-sensitivity data. |
Method selection is confirmed during device triage. Where erasure cannot be verified to the required standard, physical destruction is applied by default. Your Certificate of Data Destruction records the exact method used per serial number.
Step-by-Step
Every device follows the same five-step sanitization workflow from the moment assets arrive at our ISO 27001-certified facility. No exceptions, no batch shortcuts.
Every asset arriving from secure collection is unloaded, scanned, and reconciled against the original collection manifest. Tamper seals are inspected. Any discrepancy triggers immediate investigation and client notification before processing begins. The chain-of-custody record is continued from collection - no gap.
Each device is individually assessed: media type identified (HDD, SSD, NVMe, mobile, tape), drive health checked, and sanitization method selected according to NIST SP 800-88r2 guidance and the data classification agreed with the client. Where software erasure can be verified, Purge is preferred over Destroy - preserving asset value for the remarketing step.
Software-erasable devices are processed using Blancco Drive Eraser - an industry-standard certified tool that generate tamper-proof, digitally-signed erasure reports per device. SSDs and NVMe drives are processed using certified Secure Erase or cryptographic erase modules. Devices requiring physical destruction are shredded on-site using industrial equipment meeting NIST Destroy specifications. All destruction is access-controlled and operated under ISO 27001-certified procedures.
Every erasure result is verified. Certified erasure software generates a per-device erasure report confirming the standard applied and verification outcome. Physically destroyed assets receive a destruction record with witnessed confirmation. Both are captured in EPOKA’s asset management system against the original serial number.
Once processing is complete, we issue a Certificate of Data Destruction per device.
The certificate includes: device make and model, serial number, sanitization method (Clear / Purge / Destroy), NIST SP 800-88 Rev. 2 standard applied, date of sanitization, and EPOKA’s certifying details. This document is your legal evidence of GDPR compliance and your audit proof for data protection obligations.
The sanitization documentation is delivered as part of the complete ITAD documentation package alongside the chain-of-custody record and, subsequently, the asset settlement report and ESG sustainability report.
The Certificate of Data Destruction is the most important document you receive from an ITAD project. It is your legal evidence under GDPR, your audit proof for data protection regulators, and the document that closes your compliance obligation for every retired device.
EPOKA issues one certificate per device - not per batch, not per shipment. A batch certificate covering 500 drives cannot prove that drive #374 was specifically processed. A regulator or auditor will notice.
The certificate is delivered in audit-ready format alongside the generated erasure report. All documentation is retained by EPOKA for the agreed contractual period and available for audit recall on request.
On-site data destruction available: For organisations where assets cannot leave the premises due to classification requirements, insurance obligations, or regulatory restrictions, EPOKA can arrange certified on-site destruction with witnessed documentation and same-day Certificate of Data Destruction.
Example certificate fields shown. Actual certificates include erasure report reference, project ID, client reference, and are issued in PDF and CSV audit-ready formats.
Both methods satisfy NIST SP 800-88 when applied correctly. The right choice depends on your data classification, asset condition, secondary market value, and ESG objectives.
Software-based erasure using Blancco Drive Eraser renders data permanently irrecoverable while keeping the device physically intact and functional. The preferred method where secondary market value exists.
Choose when
Asset has secondary market value. Standard enterprise ITAD. Drive is functional and supports verified erasure. GDPR compliance needed with audit trail.
Preferred for ITADShredding, disintegration, or degaussing renders the device permanently unusable. The definitive method when erasure cannot be verified, data classification demands absolute assurance, or asset value is zero.
Choose when
Highest-classification data. Drive is damaged or erasure cannot be verified. Tape, optical, or removable media. Asset has no secondary market value.
Certifications & Compliance
EPOKA’s data sanitization operations are conducted within an ISO 27001-certified information security framework, using independently verified erasure tools and documented processes for every device.
Consistent, documented sanitization procedures. Every device follows the same certified process with no exceptions or shortcuts.
Responsible management of all physical destruction materials. Shredded media processed through certified e-waste recycling partners.
Certified information security management covering access controls, data handling, and all processing operations within our facility.
Safe working conditions for all data destruction operations, including safe handling of industrial shredding equipment.
Get a no-obligation data sanitization quote. Tell us your hardware types, quantities, and data classification requirements - Epoka will recommend the right method, provide a transparent cost estimate, and issue a Certificate of Data Destruction per device, per serial number.
Submitting this form is completely non-binding. One of our specialists will contact you shortly.
FAQ
Common questions from IT teams, CISOs, and compliance managers.
Data sanitization in ITAD is the certified process of rendering data on retired IT equipment permanently irrecoverable. It follows NIST SP 800-88 guidelines and encompasses three methods: Clear (logical overwrite for low-sensitivity assets), Purge (cryptographic or Secure Erase for assets leaving organisational control), and Destroy (physical shredding for the highest-sensitivity data or media types that cannot be software-erased). A Certificate of Data Destruction is issued for every processed device.
NIST SP 800-88 defines three methods: (1) Clear - logical overwrite protecting against simple, non-invasive recovery. Used for internal redeployment. (2) Purge - cryptographic erase or manufacturer Secure Erase commands protecting against laboratory-level recovery. Required for all assets leaving organisational control, including ITAD resale. (3) Destroy - physical shredding, disintegration, or degaussing for the highest-classification data or media types where Purge cannot be verified.
Data erasure (Blancco software-based) overwrites or cryptographically erases data while leaving the device physically intact and resaleable. Physical destruction (shredding, degaussing) renders the device permanently unusable, eliminating resale value. Both satisfy NIST SP 800-88 when applied to the correct media type. For enterprise ITAD, erasure is preferred where asset value exists; destruction is the default for tape, optical media, and highly-classified data.
A Certificate of Data Destruction is an official document confirming that a specific device has been irreversibly sanitized. Epoka issues one per device, including: device serial number, make and model, sanitization method applied, NIST SP 800-88 Rev. 1 standard reference, date of sanitization, and Epoka’s certifying details (ISO 27001 certification). This certificate is your legal evidence of GDPR compliance and the document you present to data protection regulators or internal auditors.
Yes, when properly documented. GDPR Article 17 (right to erasure) and Article 5(1)(e) (storage limitation) require that personal data is rendered permanently unrecoverable. NIST SP 800-88 Rev. 1 Purge or Destroy methods satisfy this requirement. The key is documentation: a Certificate of Data Destruction with serial-number-level detail per device is the data controller’s evidence of compliance for regulatory audits.
Yes, but they require different methods than HDDs. Standard overwrite (Clear) is insufficient for SSDs and NVMe drives due to wear-levelling algorithms that may preserve data in sectors bypassed during overwrite. EPOKA processes these using Blancco’s certified SSD and NVMe erasure modules, applying cryptographic erase or manufacturer Secure Erase commands as specified in NIST SP 800-88 Rev. 1 Purge guidance. Physical destruction is applied when those methods cannot be verified.
You receive a Certificate of Data Destruction per device, listing serial number, make and model, sanitization method, NIST SP 800-88 Rev. 1 standard, and date. For Blancco software erasure, the digitally signed Blancco erasure report is also provided. For physical destruction, a witnessed destruction record is issued. All documentation is delivered in audit-ready PDF and CSV formats and retained by Epoka for the contractually agreed period, available for audit recall on request.
Yes. EPOKA issues a Certificate of Data Destruction per device, identifying each asset by serial number and confirming the sanitization method applied, the NIST SP 800-88 Rev. 1 standard used, and the date of processing. This certificate is your legal evidence of GDPR compliance and your audit proof for data protection obligations.
