A certificate of data erasure — sometimes called a certificate of destruction or data sanitisation certificate — is a formal document confirming that a specific storage device has been securely wiped. It sounds bureaucratic, but for many businesses it’s the difference between demonstrable compliance and a liability that could surface years later.
What a Certificate of Erasure Contains
A proper certificate of erasure documents:
- Asset details — make, model, and serial number of the device
- Erasure standard used — e.g. US DoD 5220.22-M, NIST 800-88, Australian ISM-6.2.93
- Number of passes — how many times each sector was overwritten
- Verification result — confirmation the final read pass found no recoverable data
- Date and time of the erasure process
- Technician or provider details — who performed the destruction
Each device gets its own certificate, tied to its unique serial number. This creates an auditable record that a specific piece of hardware was destroyed on a specific date to a specific standard.
Who Needs a Certificate of Erasure?
Any business that holds personal information under the Privacy Act 1988 has an obligation to demonstrate reasonable steps were taken to destroy that data. A certificate of erasure is the clearest way to satisfy that obligation. In practice, the need is most acute for:
- Legal practices — client privilege and confidentiality obligations extend to data disposal
- Medical and allied health — patient records are among the most sensitive categories of personal information
- Financial services and accounting — ASIC, APRA, and AML/CTF requirements create record-keeping and destruction obligations
- Government agencies and councils — the Australian Government ISM mandates specific sanitisation standards for ICT equipment
- Any business undergoing a cyber insurance audit — insurers are increasingly asking about hardware disposal practices
Is It Legally Required in Australia?
No single law mandates a certificate of erasure by name. But the Privacy Act’s requirement to take “reasonable steps” to destroy personal information creates implicit pressure to document what you did and how. In the event of a complaint or investigation, “we wiped the laptops but didn’t keep any records” is a weak position. A certificate of erasure is the evidence.
For government agencies, the Australian Government ISM is more prescriptive — it specifies which erasure standards are acceptable and implies that disposal must be documented.
When Should You Request a Certificate?
You don’t necessarily need a certificate for every decommissioned device — a USB stick with no sensitive data is different from a server that stored 10 years of client files. Use your judgement based on:
- Whether the device held personal information about clients, patients, or employees
- Whether it was used for financial, legal, or clinical work
- Whether your industry regulator, insurer, or clients require documented disposal
- Whether the device was used by senior staff with broad data access
When in doubt, certificate it. The cost is minimal; the documentation value is significant.
Kinsoft provides certificates of erasure as part of our e-waste removal service for Sydney businesses. We wipe to your required standard and issue per-device certificates — contact us for pricing.