The certificate of data destruction: what it proves, and what it cannot

A certificate of data destruction is the document a destruction vendor issues stating what was destroyed, how, when, where and by whom. It is what the entire engagement exists to produce: the hardware is gone within days, and the certificate is what answers questions for years. Which makes it worth understanding exactly what the document can and cannot carry.

What a real one contains

• One line per device, identified by serial number.
• The media type of each device, and the method applied to it.
• The date, the location, the operator, and the witness if there was one.
• The standard or procedure the method followed.
• A reconciliation against the manifest or asset register supplied, with exceptions listed.

The exceptions line is the honesty test. Real projects produce discrepancies: a device on the register that never arrived, a drive found in a chassis that no list mentioned. A certificate that never has exceptions is describing projects that never get audited.

Per serial number, or it is a receipt

A document that says a quantity of drives was shredded on a date is a receipt for a service. It answers “did a destruction happen” and cannot answer “what happened to this device”, and audits ask the second question, as covered in the data destruction article. The difference costs the vendor a barcode scanner and some discipline, which is why its absence is informative.

What the certificate proves

That a named party has attested, in a document they signed, that specific devices were processed by a specific method at a specific time. Combined with an intact chain of custody from your floor to that process, it lets your organisation state what happened to each asset, with evidence, years later. That statement is the product.

What it cannot prove

The certificate is issued by the party that did the work, and it is exactly as reliable as that party and the custody chain behind it. A flawless certificate attached to a gap in custody proves what happened to the devices that reached the bench, and says nothing about whether all of them did. The configuration that removes that interval entirely is destruction carried out on your site. This is why the manifest, the seals and the reconciliation are not bureaucracy around the certificate. They are what gives it meaning.

Certificate is not certification

The two words get blurred in sales conversations. A certification is a third-party audit of a facility or process against a published standard, held by the vendor. A certificate of destruction is a per-job document, issued by the vendor. A certification tells you the facility was audited; it does not tell you your job was done correctly, and a certificate does not become independent evidence because the vendor holds one. Ask for both, and read each for what it actually is, alongside the questions to ask a decommissioning company before price.

Reading one before you sign

Ask for a blank example before pricing, and check it against the list above. Then ask how the records are captured during the work, because a pack assembled at the machine and a pack reconstructed afterwards from photographs are different documents with the same title. A vendor who has to construct a blank one for you has never been asked, and that is worth knowing before your project becomes the first.

Where it lands afterwards

Filed with the chain of custody entries and the register reconciliation, and kept for as long as the destroyed data would have carried obligations. In a full site exit this pack is the closing deliverable of the sequence, and the working checklist for assembling it is on the checklist page. What a per-device report should contain is on the destruction page.