Secure data destruction for business devices

When you delete a file, the operating system usually removes only the pointer to it. The data remains on the disk until something overwrites it, and freely available recovery tools can read it back. A quick format behaves the same way. This is why a laptop that “looks wiped” can still hand a stranger a client list, payroll data or saved credentials.

Solid-state drives add another wrinkle. Wear levelling and over-provisioned memory mean an SSD can hold copies of data in locations that ordinary overwriting never touches. A method that is acceptable for a spinning hard drive may be unacceptable for flash storage. That is why the right approach depends on the media, not just on the policy statement.

The consequence of getting this wrong is not abstract. A recovered drive can trigger breach notification duties, regulator attention, contractual penalties and reputational damage that far outweighs the cost of doing the job properly.

NIST Special Publication 800-88 describes three levels of media sanitization. Westmark uses that framework because it gives security teams a common language and gives auditors something to check against.

A policy that says “all drives are shredded” is simple but expensive, and it throws away resale value from devices that could have been safely purged and reused. A policy that says “all drives are wiped” is cheaper but fails on damaged media. Most organizations land on a tiered approach: highly sensitive systems and failed drives are destroyed, standard fleet devices are purged and resold, and low-risk peripherals are cleared.

Different media need different handling. Hard disk drives can be overwritten or destroyed. SSDs and NVMe modules need purge methods the device itself supports, or destruction that reaches the memory chips. Backup tapes, optical discs, USB sticks and SD cards each have their own approach. Mobile phones and tablets need factory reset plus encryption checks, or destruction if the policy requires it. Multifunction printers and copiers often hold hard drives that store scanned documents, and they are routinely forgotten.

If you are unsure how your devices should be classified, send us the inventory and your existing policy. We will propose a tiered plan and explain where each method applies.

Sanitization is only half of the assurance. The other half is knowing where the device was between your site and the process. Westmark captures serial numbers when equipment is collected, seals containers where required and tracks the load through to processing. Each handoff is recorded, which means a missing device is noticed immediately instead of being discovered months later in an audit.

You can also request witnessed handling. If your policy requires that your own staff observe destruction, tell us during scoping so we can plan the location and timing, and confirm in the written quote how that will work.

A certificate is only as useful as the detail behind it. A one-line statement saying “data destroyed” will not satisfy a serious auditor. Westmark’s certificates list the serial numbers of the devices that were wiped or destroyed, the method applied to each, and the dates of processing. They are issued alongside your project close-out report so everything is filed together.

For organizations that must prove destruction to their own clients, a serial-level certificate can be passed straight through. For internal audit, it reconciles directly to the asset register. If your security team has a required template or additional fields, send it with the inventory and we will align the report to it.

PIPEDA requires organizations to protect personal information with safeguards proportionate to its sensitivity, and that duty continues through disposal. Ontario health-care custodians have additional obligations under PHIPA. Public-sector bodies and regulated financial institutions typically add their own retention and disposal rules. Contracts with enterprise clients often specify destruction standards by name.

Data destruction is one control among several, and your privacy or legal team owns the interpretation of the rules that apply to you. What we provide is the operational side: a method that matches your policy, a record that stands up to review and a process that does not depend on anyone remembering to wipe a laptop.

Preparation is straightforward. Gather devices in a secure, access-controlled room. Do not strip or reimage them unless your policy requires it. Provide an inventory with counts by device type and, if you have them, asset tags. Flag anything with unusually sensitive content, any failed drives and any equipment that is leased or under legal hold, since those items follow different rules.

We serve Toronto, the wider GTA, Windsor, Moncton, Fredericton and Halifax, and can arrange evening or weekend collection where building rules require it.