Every organisation eventually retires equipment. Laptops are replaced, servers are decommissioned and drives pile up in storerooms. Each one still holds the data it was used for. Certified data wiping is how you make sure that information is gone for good, and how you prove it afterwards.
What does “certified” mean in data wiping?
“Certified” is not a legal term, so it helps to know what people usually mean by it. In practice it covers two things. First, the erasure itself is verified: the software or firmware command is run, the result is checked and the outcome is recorded against each device. Second, you receive a document, a data erasure certificate, that records what was erased, how and when. Some vendors also have their erasure tools independently assessed, which adds another layer of assurance.
When a supplier says its wiping is certified, ask which of these they mean. A certificate without verification is only a piece of paper.
Why deleting or formatting is not enough
Deleting a file removes the entry that points to it, not the data itself. A quick format behaves in much the same way. Recovery software can often bring the information back. That is why organisations rely on proper erasure, which overwrites the data or destroys the encryption keys that protect it. Our guide to what data wiping is explains the difference in more detail.
What a good erasure certificate includes
A useful certificate is specific. Look for:
- The device type, make, model and serial number
- Your own asset number, where supplied
- The erasure method used
- The date and time of the erasure
- The verification result, pass or fail
- The organisation that carried out the work
A certificate that only gives a total number of drives is much harder to defend in an audit than one that lists every serial number.
The standards behind certified wiping
The best-known reference is NIST SP 800-88, the US guidance on media sanitization. Its Revision 2 was finalised in September 2025 and builds on the long-standing Clear, Purge and Destroy model. IEEE 2883 is another standard written specifically for storage sanitization. Neither is a UK legal requirement, but both are widely used as benchmarks. Our page on NIST 800-88 data erasure explains the three methods and what changed.
Why it matters for UK organisations
Under UK GDPR you must protect personal data and be able to demonstrate that you did. A drive that leaves your control with data still on it can become a reportable personal data breach. The most serious infringements can attract fines of up to £17.5 million or 4% of global annual turnover, whichever is higher. Beyond the regulator, there is the damage to trust if a customer’s or patient’s information turns up on a second-hand drive.
Certified wiping answers the accountability question directly. You can show an auditor, a client or the ICO exactly what happened to each device. Read more in our guide to GDPR and data erasure.
How certified data wiping works, step by step
- Scope: you tell the provider what needs wiping, with a list or photo if possible.
- Quote: a clear, fixed quote is agreed.
- Collection or attendance: equipment is collected securely, or wiped at your premises.
- Erasure: each device is wiped with a method suited to its media, for example overwrite for hard drives and firmware commands for SSDs.
- Verification: the result is checked and recorded by serial number.
- Certificate and report: you receive your proof, and any drive that cannot be wiped goes to certified destruction.
Questions to ask any provider
- Does the certificate list individual serial numbers?
- Which method is used for each type of device?
- How is the result verified?
- How is equipment tracked from collection to completion?
- What happens to drives that fail?
- Is there a written agreement covering data protection?
Wiping or destruction?
Certified wiping suits working equipment you want to reuse, resell or recycle. Drives that are faulty or too sensitive to keep should be destroyed instead. Many organisations combine both. We compare them in data wiping vs data destruction.
Frequently asked questions
Is certified data wiping a legal requirement? No law names a certificate, but UK GDPR expects you to protect personal data and demonstrate compliance. A certificate is the clearest evidence you can hold.
Can wiped data be recovered? When a drive has been wiped correctly with a suitable method and the result verified, recovery is not practical.
Does a certificate transfer responsibility to the wiping company? No. As the data controller you remain accountable, so keep a written agreement and your records as well.
Get certified wiping for your equipment
We wipe hard drives, SSDs, laptops, servers and mobiles across the UK, with free collection and a certificate for every job. Get a free quote and we will reply within 24 hours.
