Certificate of Destruction: Meaning, Samples and When You Need One.
Two real-format sample reports, redacted and annotated field by field, free to download as PDF. Plus what a certificate of destruction means and when it is required.
A certificate of destruction is written proof that the data on specific devices was destroyed. A good one lists every device by serial number, states the method and the date, and is signed by the company that did the work. It is required whenever you must prove data was destroyed: audits, client contracts, lease returns, personal data erasure and any time retired devices leave your control.
Below are two sample erasure reports, redacted and annotated. Download them free. No email needed.
Certificate of destruction sample PDFs, explained.
Each numbered box on the sample matches a numbered note below it. Serial numbers, network addresses, unique IDs and signatures have been removed before publishing.
- Report ID. Report number and digital identifier.
- Report date. When the report was generated.
- Software. Erasure software and version.
- Selected method. NIST 800-88 Purge, the purge level of the NIST media sanitisation guidelines.
- Summary. Successful and failed disk counts. Anything other than zero failures needs a follow-up.
- Device. The laptop model.
- System serial. Redacted. Matches your asset register on a real report.
- Drive. Drive model, serial (redacted), size, media type and SMART status.
- Verification. Total verification: every sector was read back after erasure.
- Time. Start time, end time and duration.
- Status. Completed means the erasure and verification finished.
- Signatures. Technician and validator sign-off. Redacted here.
- Licensed to. The licensed erasure operator. Here, Greenlife Ewaste Recycling Pvt. Ltd.
- Drive. Make, model, capacity and serial number of the drive that was erased. The serial is what ties the report to your asset register.
- Start, end and duration. When the erasure ran. Times are in UTC on this report.
- Method. The erasure standard applied and the number of rounds. This job used HMG Infosec Standard 5, Lower Standard, with one overwrite. The standard is chosen per job and printed on every report.
- Status. The result. Erased means the process completed.
- Health. Drive health recorded at the time of erasure, useful when the drive is resold.
- Device. The laptop the drive came from.
- Device serial. Redacted here. On your copy it matches the serial in your asset register.
- Report UUID. A unique ID for this report. Partly redacted here.
- Software. Erasure software and version.
- Digital signature. Tamper evidence. Editing the report breaks the signature. Redacted here.
What a certificate of destruction means.
In IT asset disposal, a certificate of destruction is the record that closes the life of a device. It connects a device that was in your building to an event that made its data unrecoverable. Without the serial number link, it proves only that a pickup happened.
The certificate usually sits on top of other records. Software wiping produces a per-drive erasure report like the samples above. Physical destruction produces a Certificate of Destruction, with a list of serials when your audit asks for one. The certificate of destruction summarises these for the whole job.
A certificate of destruction is required when...
- Audits. ISO/IEC 27001:2022 includes a control for secure disposal or re-use of equipment. Auditors ask for evidence that storage media was sanitised.
- DPDP Act, 2023. The Act requires data fiduciaries to protect personal data with reasonable security safeguards and to erase it once its purpose is served. The DPDP Rules were notified on 13 November 2025, and most of these duties apply from May 2027. Building the disposal record now avoids a scramble later.
- Client contracts. Many client agreements require proof that their data was destroyed when devices were retired.
- Lease returns. Before returning leased laptops, you need proof the data left with the device was destroyed.
- Regulated sectors. Banks, NBFCs, insurers and hospitals are asked for disposal records by auditors and regulators.
- Any handover. Whenever retired devices leave your control, for resale, donation or recycling.
Destruction certificate vs erasure certificate vs recycling certificate.
| Document | What it proves | Who issues it |
|---|---|---|
| Erasure report or certificate of erasure | Data on one drive was wiped by software, with verification | The erasure operator, generated by the software |
| Certificate of destruction | Data on a list of devices was destroyed, by method and date | The ITAD or destruction company |
| Certificate of e-waste recycling | Hardware was recycled through an authorised channel | The authorised recycler |
| Form 6 manifest | E-waste moved from you to an authorised recycler | Filled at collection |
How to check a certificate is genuine.
- Check that every serial number on the certificate is in your asset register, and every retired device in the register is on a certificate.
- Check the method matches your policy. SSDs need a purge-level method or shredding. Degaussing does not work on SSDs.
- Check the dates. Destruction should come before any resale.
- Check it is signed and names the licensed operator.
- For software erasure, ask for the per-drive reports. Signed reports from recognised software are hard to fake.
For a deeper checklist, read what a certificate of destruction should actually contain.
Questions, answered.
A certificate of destruction is a document that proves data on specific devices was destroyed. A useful one names the client, lists each device by serial number, states the method used and the date, and is signed by the company that did the work.
In IT asset disposal, it means written proof that the data on retired drives, laptops, phones or tapes was made unrecoverable, by wiping, degaussing or shredding, and that this happened before the hardware was resold or recycled.
Whenever you need to prove data was destroyed: during an ISO 27001 or internal audit, under a client contract, when returning leased equipment, whenever retired devices leave your control, and, as the DPDP Act, 2023 comes fully into force, when personal data has to be erased.
Not quite. A certificate or report of erasure covers software wiping, where the drive survives and can be reused. A certificate of destruction usually covers physical destruction or the overall disposal, and often summarises the erasure reports. Many companies ask for both.
Yes. This page has two redacted and annotated sample erasure reports as free PDFs, with every important field numbered and explained. No email is required.
Keep them at least as long as you keep the asset records they relate to, and as long as your audit, contract or regulatory obligations require. Many companies keep them for several years. Your auditor or legal team can set the exact period.
The company that performed the destruction or erasure. For PrivAce jobs, processing runs through Greenlife Ewaste Recycling Pvt. Ltd., the licensed operator named on the reports.
Last reviewed 30 September 2026. Sources: DPDP Rules, 2025 (PIB), NIST SP 800-88 Rev. 2.
Need certificates for your next disposal?
Every PrivAce job comes with a Certificate of Destruction, plus per-drive erasure reports for wiped media. Tell us what you are retiring.
