Is physical destruction a form of data sanitization? It depends whose vocabulary you use

Ask whether physical destruction counts as data sanitization and you will get a confident yes from some people and a confident no from others. Both can be right, because the word sanitization is used in two different ways. What matters for a buyer is which meaning a contract or a certificate is using.

The NIST answer: yes

NIST SP 800-88 defines media sanitization broadly, as a process that renders access to target data on the media infeasible for a given level of effort. Within that definition it describes three categories: clear, purge and destroy. In that vocabulary, physical destruction is one form of sanitization, the one that leaves the media unusable. The guideline is summarized on NIST 800-88.

The narrower usage: no

Some training materials and some industry usage reserve sanitization for methods that remove data while leaving the media reusable, such as overwriting or cryptographic erase, and treat destruction as a separate category. In that usage, physical destruction is not sanitization; it is destruction. Exam questions built on that framing expect the answer that destruction is not a form of sanitization.

Why the difference matters in a contract

If a contract requires all drives to be sanitized and the vendor reads the word in the narrow sense, it may plan to erase and resell everything, including drives your policy says must be destroyed. If the vendor reads it in the broad sense, it may shred drives that you expected to be erased and returned for value. Either way, one side is surprised. Defining the term, or better, specifying the method per media type, removes the ambiguity.

What each one proves

Destruction proves that the device no longer exists in usable form, and with a suitable particle size that the data cannot be recovered. Verified erasure proves, by reading the device back, that the data is gone while the device survives. They answer different needs, and the trade off is set out in destruction or verified erasure.

Destruction still needs a record

Whatever vocabulary you use, the evidence is the same: serial numbers recorded before destruction, the method and equipment used, the date, the operator and the witness if any. Destruction without a record is only a bin of fragments. The certificate that ties those elements together is described on certificate of destruction.

A safer way to write the requirement

Rather than asking for sanitization, specify the outcome per media type: for example, verified erasure for working hard drives that will be resold, physical destruction for failed drives and for flash media holding sensitive data. That wording leaves no room for two readings and makes the certificate easy to check against the requirement.

The short answer

Under NIST SP 800-88, yes, physical destruction is a form of sanitization. In some other usages, no, it is a separate category. In a contract, do not rely on either: name the method you require for each kind of device, and the record that proves it was applied.

The same care applies to related words. Wipe, erase, purge and destroy are used loosely in sales material and precisely in standards. When a proposal uses one of them, ask which method it means and what record will show it, and the vocabulary question disappears.

Why exam questions keep asking it

Certification exams use this question because it tests whether a candidate knows that definitions differ between frameworks. In the field, the lesson is the same one: before agreeing on a method, agree on the words. A two line definition section in a statement of work costs nothing and prevents the most common dispute in data destruction projects, a vendor that did exactly what the contract said and not what the customer meant.

If a vendor uses its own definitions, ask for them in writing and compare them with the ones in your policy. Where they differ, the contract should say which one prevails.