Certified data erasure & data carrier destruction – GDPR-compliant, verifiable, cost-effective
Deletion in accordance with NIST SP 800-88 · Destruction in accordance with DIN 66399 / ISO IEC 21964 · Deletion certificate for each data carrier · Archived for 10 years
Data erasure is mandatory – proof determines your liability
Data protection does not end when a device is decommissioned – in fact, that is often when it really begins. The GDPR requires, in Article 17 , the erasure of personal data that is no longer required and, in Article 32 , technical and organisational measures that are proportionate to the protection required. However, the decisive factor is Article 5(2) , which concerns accountability: it is not the regulatory authority that must prove you have failed to comply – you must be able to demonstrate that the data has been properly erased. Without audit-proof evidence of erasure, even the most thorough erasure simply does not exist in legal terms.
The consequences are very real: under Article 83 of the GDPR, fines can amount to up to 20 million euros or 4 per cent of global annual turnover . Added to this are reputational damage and the risk of personal liability for the management. With the NIS 2 Directive, the requirements for traceability and supply chain due diligence have increased further. Formatting, quick deletion via the operating system or removing the partition table do not meet these requirements – the data remains recoverable using freely available tools.
The actual product is not the deletion itself. It is the proof that the data has been deleted. That is why we provide a certificate for every data carrier – and retain it for you for ten years.
The IT-RESELL process in 6 steps
Every order goes through six clearly defined stages. Each stage delivers a documented output to the next – and from day one, you’ll see exactly what we see in your customer portal.
Assessment & Quotation
You send us a list of devices or we carry out an on-site assessment. You’ll receive a model-specific valuation, including residual value.
Dismantling & Collection
Nationwide collection in lockable, sealed transport containers. Direct transport, documented chain of custody with seal numbers and handover report.
Certified data erasure
Each data carrier is recorded individually and erased in accordance with NIST 800-88 using certified erasure software. Media that cannot be erased are destroyed in accordance with DIN 66399.
Inspection & Residual Value
Technical diagnosis (functionality, battery health, RAM, network), classification into grades A to D, final residual value assessment.
Remarketing or recycling
Reusable devices are refurbished and remarketed; components that can no longer be reused are sent for certified material recycling in accordance with the ElektroG.
Payment & Documentation
Residual value payment plus a full final report with erasure certificates for each data carrier, proof of destruction and a carbon footprint – available on the portal for 10 years.
A typical medium-sized order (50–200 assets) is processed within 18 to 28 working days – from written order confirmation to the handover of the final report.
Software-based erasure or physical destruction
Not every data carrier requires the same approach. A functional drive with residual value is deleted using software and reused; a faulty drive is physically destroyed. Both methods result in the verifiable, irreversible unreadability of your data – but only the first preserves the residual value.
Certified erasure – preserving value
We use certified, standards-compliant erasure software that generates a digitally signed, audit-proof log for every data storage medium – including for enterprise scenarios and self-encrypting drives.
- Clear: logical overwriting with verification – typically used for magnetic hard disk drives (HDD)
- Purge: firmware-based secure erase/sanitise commands and cryptographic erase – typically used for SSDs/NVMe
- Verification and SMART analysis after every erasure process
- The data storage medium is preserved for reuse – as is its residual value
Physical destruction – certified and documented
If a data carrier can no longer be securely erased using software – for example, in the case of hardware faults or unresponsive drives – it is physically destroyed by our specialist disposal company, certified to DIN 66399.
- Hard disk drives (HDDs): Shredding to security level H-5 (standard)
- SSD/flash media: Destruction to E-3 / H-5
- Separate certificate of destruction in accordance with DIN 66399 for each data carrier
- Material recycling of residual materials in accordance with the ElektroG
Not all SSDs are the same as HDDs – why the method must be tailored to the medium
For traditional magnetic hard disk drives (HDDs), clean overwriting with verification is sufficient, as every logical sector is physically addressable. SSDs and NVMe drives work fundamentally differently: through wear levelling and over-provisioning, the controller distributes data across memory cells that remain hidden from the operating system – a simple overwrite does not reliably reach these reserve areas. That is why, for solid-state media, we rely on firmware-based sanitisation commands and cryptographic erasure: the internal encryption key is deleted, rendering all data cryptographically unusable in a fraction of a second. Where the drive does not execute these commands correctly, physical destruction is the only secure option. It is precisely this distinction that many providers overlook – we address it as standard.
Standards in detail – NIST 800-88, DIN 66399, BSI, GDPR
NIST SP 800-88 Rev. 1 – the three sanitisation categories
| Category | What happens | Typical use |
|---|---|---|
| Clear | Logical overwriting using standard commands; protects against simple recovery | HDDs, reusable storage media |
| Purge | Firmware-based methods (Secure/Block Erase, Cryptographic Erase, degaussing); even laboratory methods fail | SSD/NVMe, self-encrypting drives |
| Destroy | Physical destruction (shredding, crushing, melting down); storage medium rendered unusable | Defective / non-erasable data storage media |
DIN 66399 / ISO/IEC 21964 – protection classes, security levels, material classes
DIN 66399 is the German standard for the destruction of data carriers; its international equivalent is ISO/IEC 21964. It defines 3 protection classes (Class 2 covers most personal data relevant to the GDPR; Class 3 covers special categories as per Article 9 of the GDPR), 7 security levels and 6 material classes (P: paper, F: film, O: optical media, T: magnetic media, H: hard disks, E: electronic media such as SSDs and USB sticks).
| Data carriers | Material class | Recommended level (Protection Classes 2–3) | IT-RESELL standard |
|---|---|---|---|
| Hard disk drive (HDD) | H | H-4 (minimum) to H-5 | H-5 |
| SSD / NVMe / USB / memory card | E | E-3 (minimum) to E-4/E-5 | E-3 / H-5 |
Due to their high storage density, SSDs/flash drives require finer particle sizes than HDDs. Anyone who treats solid-state media in the same way as magnetic disks underestimates the residual risk.
BSI IT-Grundschutz – Module CON.6
The BSI’s IT-Grundschutz Compendium addresses this topic in Module CON.6 ‘Deletion and Destruction ’: a regulated, documented procedure for the deletion and destruction of information and data carriers – precisely what our six-step process, complete with chain of custody and certificates, provides.
GDPR – Articles 17, 28, 32 and accountability
| Article | Requirement | How IT-RESELL meets them |
|---|---|---|
| Art. 17 | Right to erasure of personal data no longer required | Certified erasure in accordance with NIST 800-88 or destruction in accordance with DIN 66399 |
| Art. 28 | Data Processing Agreement (DPA) for external processing | Sample DPA included – erasure, verification and documentation are expressly covered by the contract |
| Art. 32 | Appropriate technical and organisational measures (TOMs) | Sealed containers, direct transport, access and video monitoring, operator IDs, hash verification |
| Art. 5(2) | Accountability – you must demonstrate compliance | Audit-proof deletion certificate for each data carrier, archived for 10 years |
Your proof of deletion – audit-proof, individual, archived for 10 years
For each individual data carrier, we issue a personalised, audit-proof deletion certificate – including the device and data carrier serial numbers, the standard used and software version, operator ID, timestamp and verification result. In the case of physically destroyed data carriers, proof of destruction in accordance with DIN 66399 is also provided.
The difference compared to most providers is this: with us, the certificate is automatically linked to the relevant asset – not because someone ticks a box, but because the certificate is only generated once the deletion process is complete. Everything is stored in your ITAD customer portal , hosted in Germany, with a search function down to the individual serial number across all projects. And we archive every project for ten years .
In practical terms, this means that if your IT manager leaves the company next year, the complete documentation remains in-house. And if an audit takes place in three years’ time, nobody needs to search through old email inboxes – the proof is just a click away.
Proven by real-world practice: we erase tens of thousands of data carriers and storage media every year – from servers, storage systems, laptops and mobile devices. Each and every one comes with audit-proof verification; drives that cannot be erased are subjected to documented physical destruction in accordance with DIN 66399.
Data erasure + purchase = revenue rather than costs
Traditional document shredders and waste disposal companies charge per shredded data storage medium – for you, this is purely a cost item. We take the opposite approach: every purchase transaction with IT-RESELL already includes certified data erasure in accordance with NIST 800-88 – complete with a certificate of erasure. Instead of paying for destruction, in most cases you’ll receive a residual value credit for your hardware.
This pays off twice over: a fully functional hard drive or laptop that is erased rather than shredded retains its market value. Enterprise hardware from HPE, Dell, Cisco, Juniper, HPE Aruba, NetApp, Pure Storage and NVIDIA often still has considerable residual value – even after three to five years of use. This allows you to recoup the cost of compliance through the purchase, rather than treating it as an expense.
Why erasure is better for the environment than destruction
A destroyed data storage device is electronic waste. A deleted data storage device is a product that lives on. The difference is measurable: the majority of an IT device’s CO₂ emissions are generated during manufacture, not during operation. Anyone who reuses a device after certified data erasure avoids the emissions associated with manufacturing a new one.
A real-world example: When processing 103 Dell Latitude laptops for an IT service provider, 100 data storage devices were certified as deleted in accordance with NIST 800-88, whilst three faulty SSDs were physically destroyed (DIN 66399, H-5). The result: a reuse rate of 97.1 per cent and around 31 tonnes of CO₂e in manufacturing emissions avoided compared with new production. The context makes this a matter of urgency: according to the United Nations’ Global E-waste Monitor 2024, 62 million tonnes of electronic waste were generated worldwide in 2022 – only 22.3 per cent of which was documented as having been properly recycled. Every reused device improves this balance and your ESG/Scope 3 reporting.
From SMEs to data centres
Companies & SMEs
Regular hardware refreshes, site closures, lease returns: documented data erasure with residual value.
Data centres & cloud migrations
Data centre decommissioning involving large volumes of data storage media (servers, storage, Switches), chain of custody and bulk data erasure.
System integrators & IT service providers
White-label-compatible, audit-proof data erasure and destruction as a building block for your own client projects.
Government agencies & public bodies
Highest level of protection required, DIN 66399 protection classes 2–3, comprehensive documentation, EU data processing.
Everything at a glance
The question is not whether you are disposing of hardware, but whether you can subsequently prove what happened to the data.
We ensure that you can – at any time, for every single data carrier. Free of charge, with no obligation, and with a model-accurate residual value assessment.
.png?ts=1773652689)
Frequently asked questions about data erasure and data carrier destruction
Answers to questions about procedures, standards, costs and certification – from the erasure method to archiving in the customer portal.
Data erasure involves the irreversible removal of data using software in accordance with NIST 800-88; the data carrier remains reusable. Data carrier destruction involves the physical destruction of the medium in accordance with DIN 66399. Data erasure preserves the residual value; destruction is the solution for defective or non-erasable data carriers.
No. Formatting, emptying the Recycle Bin or deleting the partition table only removes the references; the data remains recoverable using freely available tools. Only a certified procedure with verification and audit-proof evidence is GDPR-compliant.
With SSDs, simple overwriting is not a reliable method, as wear levelling and over-provisioning conceal storage areas. We use firmware-based sanitise commands and Cryptographic Erase (NIST Purge); in the event of defects, physical destruction follows.
A data erasure certificate provides audit-proof documentation for each data carrier, confirming that erasure has taken place and detailing the method used. It serves as your proof to data protection authorities and auditors in fulfilment of your accountability obligations under Article 5(2) of the GDPR.
DIN 66399 Protection Class 2 applies to most personal data, whilst Protection Class 3 applies to particularly sensitive data. For hard disk drives, levels H-4 to H-5 are recommended; for SSDs, levels E-3 to E-5. IT-RESELL carries out destruction to H-5 standard.
The obligation is to ensure the secure, verifiable disposal of data – not necessarily physical destruction. Certified data erasure also complies with the GDPR and preserves the value of the device.
Hand over the data storage media to a service provider with an AVV (Waste Management Agreement), certified erasure/destruction and proof of compliance. IT-RESELL collects sealed consignments nationwide, carries out certified erasure or destruction, and provides comprehensive documentation.
The price depends on the quantity, type of data storage medium and the method used. In most cases, when combined with the buyback of the hardware, you will incur no costs but will instead receive a credit for the residual value.
Both. DIN 66399 is the German standard, whilst ISO/IEC 21964 is its international counterpart, which is identical in content. We operate in accordance with both.
Ten years. Every project, including all erasure and destruction certificates, is archived in the ITAD customer portal (hosted in Germany) and is searchable down to the individual serial number.
Yes. You can audit our refurbishment and data erasure site in Magdeburg – including access controls, data erasure lines, the software used and logging procedures. This is particularly relevant for ISO 27001 and TISAX requirements.
