StarLabs Glossary / IT Procurement Terms
Certified Data Erasure
Wiping a device so its data cannot be recovered, and keeping proof that you did.
Certified data erasure is the process of permanently removing all data from a laptop, phone or drive using a recognised method, checking that it worked, and issuing a certificate for each device. The certificate records the serial number, the method used, the date and the result, so you can show the data was properly destroyed.
How it works
Deleting files or emptying the recycle bin does not remove data. It only marks the space as free, and recovery tools can often bring files back. A factory reset is better, but on its own it gives you no record of what happened. Certified erasure uses a defined method, verifies the result and documents it.
The most widely used reference is NIST Special Publication 800-88, Guidelines for Media Sanitization, from the US National Institute of Standards and Technology. It sorts methods into three levels:
| Level | What it means | Typical use |
|---|---|---|
| Clear | Overwrites the storage areas a user can normally reach, using standard read and write commands | Reusing a device inside your own business |
| Purge | Uses methods such as the drive’s built-in sanitise command or cryptographic erase, so data cannot be recovered even with lab tools | Selling, returning or donating devices |
| Destroy | Physically destroys the media, for example by disintegration, incineration or melting | Broken drives, or very sensitive data |
Why SSDs need purge, not a simple overwrite
Older hard drives store data in fixed places, so writing over every sector clears it. Solid-state drives (SSDs), which almost all modern laptops and every phone use, work differently. To spread wear, the drive moves data around and keeps spare areas that the computer cannot see. An overwrite tool can report success while old copies still sit in those hidden areas. NIST’s current guidance also notes that repeated multi-pass overwrites are unnecessary and can shorten the life of flash storage.
For SSDs, the safer route is a purge method: the drive’s own sanitise or secure erase command, or cryptographic erase. Cryptographic erase works on drives that encrypt everything they store; destroying the encryption key leaves the data unreadable. This is why turning on BitLocker or FileVault from day one makes the end-of-life wipe much more reliable.
What it means for your business
Under Singapore’s PDPA, your duty to protect personal data does not end when a device is thrown away. The PDPC’s guidance says simply dragging files to the trash is not enough, that your organisation stays accountable even if you hand disposal to a vendor, and that you should keep records of collection and destruction. Before any laptop or phone leaves the business, whether sold, returned from a lease, traded in or recycled, ask for a per-device erasure certificate and file it against the device in your asset register.
Common questions
Is a factory reset enough before selling a company laptop?
On a fully encrypted modern device, a proper reset can act as a cryptographic erase. But a reset gives you no proof, and on unencrypted drives it may leave data behind. For business devices, use a verified erasure method and keep a certificate.
What should a data erasure certificate show?
The device make, model and serial number, the drive serial if available, the erasure method and standard, the date, whether verification passed, and who carried it out.
What if the drive is broken and cannot be wiped?
Then it should be physically destroyed by a method suited to the media, and you should get a destruction record listing the serial number.
Related terms
PDPA →IT Asset Register →Leasing vs Buying →BitLocker Recovery Key →Data Breach Notification →Retiring a batch of old laptops?
Plan the refresh and the safe disposal together with our procurement team.
Sources: NIST SP 800-88 Rev. 2 FAQ, PDPC: How can your organisation dispose of personal data
Reviewed by the StarLabs technical team · Last checked 18 October 2026
