What Is Data Wiping? A Plain-English Guide

What Is Data Wiping?

Data wiping, also called data erasure or secure erasure, is the process of permanently removing the data stored on a drive using software or built-in drive commands, so that it cannot be recovered by any practical means. Done properly, the drive still works afterwards, which means the equipment can be reused, resold, returned to a lessor or recycled without exposing the information it once held.

It is the standard way organisations protect personal data, financial records, patient information and intellectual property at the end of an equipment lifecycle. Every wipe should be verified and documented, so you hold evidence that the data has gone. That evidence is the data erasure certificate.

Why Deleting or Formatting Is Not Enough

When you delete a file, the operating system normally just marks the space as available and removes the entry from the file index. The underlying data stays on the drive until something happens to overwrite it, and widely available recovery tools can often bring it back. A quick format behaves in much the same way.

This is why second-hand drives so often turn out to contain personal files, emails and credentials. The risk is not theoretical: a single drive that leaves your control unwiped can become a reportable personal data breach. See how this links to the law in our guide to GDPR and data erasure.

How Secure Data Wiping Works

There is more than one way to erase a drive. The right choice depends on the type of media, its health and the sensitivity of the data. Modern erasure software chooses the appropriate technique for each device and then proves the outcome.

Verification matters as much as erasure

A wipe that has not been checked is only an assumption. Good erasure software reads back the drive after the process, confirms the result and records it against the device serial number. Failed or partial wipes are flagged so the drive can be retried or sent for data destruction.

For the standards behind these methods, including the Clear, Purge and Destroy categories, read our guide to NIST 800-88.

Wiping Hard Drives vs SSDs

Traditional hard disk drives (HDDs) store data magnetically in fixed locations, so overwriting those locations is effective. Solid-state drives (SSDs) work differently. They use flash memory with wear levelling and over-provisioned areas, which means the drive controller decides where data physically sits. A simple software overwrite from the operating system may never reach every cell.

• HDDs: overwrite-based erasure is well established and reliable. See our hard drive wiping service.
• SSDs and NVMe: use flash-aware methods such as firmware sanitize commands or cryptographic erase. See our SSD wiping service.
• Failed or damaged drives: if a drive will not respond, it cannot be wiped and should be physically destroyed instead.

Data Wiping vs Data Destruction

Wiping and destruction both protect your data, but they suit different situations.

Many organisations use both: wipe everything that can be wiped, and destroy anything that cannot. Our data destruction service covers the second part.

When Should You Wipe Your Data?

Wipe a device whenever it is leaving your direct control or being repurposed. Typical triggers include:

• Laptop, desktop or server refresh cycles
• Office moves, closures and data centre decommissioning
• Leased equipment being returned
• Equipment being donated, resold or passed to another team
• Staff leaving and devices being reissued
• Servers and storage arrays reaching end of warranty

Waiting until equipment is in a storeroom does not remove the risk. Unwiped drives sitting in cupboards are a common source of loss and theft, so it is good practice to wipe at decommissioning rather than later.

What Proof Should You Receive?

Under data protection law you must be able to demonstrate what you did, not just claim it. A proper data erasure certificate should include:

• The device make, model and serial number
• The erasure method used and the software or tool
• Date, time and result (pass or fail) of each wipe
• Verification outcome
• The operator or organisation that carried out the work
• Your reference or asset number, where supplied

Keep these records with your IT asset register. They are the evidence an auditor or regulator will ask for.

Our Data Wiping Process

1. Send details. Tell us what needs wiping, with a list or photo if you can.
2. Free quote. We review your equipment and send a clear, fixed quote within 24 hours.
3. Collect and wipe. We arrange free secure collection and wipe off-site, or attend your premises for on-site data wiping.
4. Certificate and report. Once verified, you receive a certificate and full report. Anything that cannot be wiped goes to certified destruction.

For the full walkthrough, see how it works.

Common Data Wiping Mistakes

• Relying on delete, format or factory reset
• Using an overwrite tool that cannot reach SSD flash cells
• Skipping verification, so failures go unnoticed
• Not recording serial numbers, leaving no audit trail
• Wiping some devices but forgetting phones, tablets, printers and network kit
• Handing equipment to a recycler without a signed erasure or destruction record