When retiring servers, drives or removable media, the commonest problem is not the gear itself but data still on the carrier. This page explains methods and boundaries: helping you judge which tier to use, not deciding compliance for your company. The overall ITAD and buyback flow is in the data-centre ITAD procurement and buyback guide.

Start with data sensitivity and media type

Before choosing a method, sort along two axes:

  • Data sensitivity: whether the media holds personal data, trade secrets, customer records or account-related information; higher sensitivity leans toward verifiable or physical handling.
  • Media type: HDD, SSD／NVMe, USB／memory card, tape; sanitisation methods differ widely by carrier.

Within one batch, different drives may need different methods; a single standard should not cover all of them.

The NIST SP 800-88 Revision 2 decision logic

NIST SP 800-88, Guidelines for Media Sanitization, is a widely used reference for sanitisation decisions. Revision 2 was issued in September 2025, replacing the earlier Revision 1. The current text on csrc.nist.gov governs; verify the latest version and its scope before handling.

The document tiers handling strength from light to strong:

  • Clear: overwriting and similar methods make ordinary reading unable to recover data; suited to low-sensitivity media that will be reused.
  • Purge／verified sanitisation: clearing followed by verification; suited to higher-sensitivity scenarios where a record is needed.
  • Destroy: physical destruction such as shredding or grinding, so the media cannot store or be read again.

Which tier maps to which media should be judged against the current NIST text together with your own data classification.

Choosing between clearing, verified clearing and destruction

  • Reusable, low sensitivity: clearing or verified clearing usually suffices, with a record of method and result.
  • Personal or commercially sensitive data: lean toward verified clearing; if the media will not be reused, physical destruction sets the clearest boundary.
  • Gear resold or handed to a third party: state the sanitisation method and certificate before handover, so data responsibility does not travel with the equipment.

Common misjudgments with damaged drives and solid-state media

  • SSD／NVMe should not rely on overwrite alone: wear levelling, over-provisioning and controller mapping mean overwrite may not reach all memory cells; damaged or encrypted solid-state media are often safer to handle physically.
  • A damaged HDD is not treated as cleared: bad tracks or circuit failure do not mean data is gone; readable parts may still be recovered.
  • Quick format is not clearing: the file table is emptied, but the data area usually remains.
  • Deleting a file is not destruction: a single file deletion or emptying the bin does not constitute media-level sanitisation.

What a certificate can and cannot state

A credible record usually states media type and serial number, method used, date, executor and verification result (if any). It cannot state:

  • an absolute promise that data is “100% unrecoverable”;
  • certifications or qualified status we do not hold and have not verified;
  • a judgment that a particular industry or regulatory scenario is fully compliant.

A certificate evidences process and record; it is not legal advice. The final compliance judgment must be confirmed by you or a qualified adviser under the applicable rules.

Reading alongside the Hong Kong PCPD guidance

The Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong, Guidelines on Deletion and Anonymisation of Personal Data, can be read alongside the methods above: when deleting or anonymising personal data, keep a corresponding record and describe the method used. This section is editorial reference, not legal advice; the public guide PDF is on pcpd.org.hk. Our own website data handling is in the privacy policy.

FAQ

Q: Is formatting a drive enough before disposal? A: No. A quick format only empties the file table; the data area usually remains. Choose clearing, verified clearing or physical destruction by sensitivity.

Q: Is one overwrite on an SSD safe? A: Not necessarily. Wear levelling and over-provisioning mean overwrite may not cover all cells; sensitive or non-reused solid-state media usually lean to physical destruction.

Q: Can a certificate say data cannot be recovered? A: This absolute wording is not recommended. A certificate records media, method, date and verification result; unrecoverability is a conclusion that cannot be absolutely guaranteed.

Q: Will you decide compliance for us? A: No. We provide method, acceptance and record process; the compliance judgment must be confirmed by you or a qualified adviser under applicable rules.

Next step

Note: this page explains methods and boundaries, citing NIST SP 800-88 and the Hong Kong PCPD public guidance as references; official current text governs. It is not legal advice and does not guarantee data is unrecoverable in every scenario. Actual handling and liability follow the quote and the terms of service.