How to Prove Data Was Destroyed for an Audit.
The ten documents in a complete IT disposal evidence pack, how auditors test them, and a free checklist to build yours.
To prove data was destroyed, you need an evidence pack that links each retired device in your asset register to a destruction record. That means a serial-level handover signed by both sides, per-drive erasure reports or a destruction log, a Certificate of Destruction listing every serial, and a reconciliation note showing your register and the certificates match. A certificate on its own proves only that some devices were destroyed, not that yours were.
Ten documents, one trail.
| Document | What it proves | Who produces it | When |
|---|---|---|---|
| Disposal policy | Who approves disposal, which method applies to which media, onsite or offsite rules | You | Reviewed yearly |
| Retirement approval | These assets were approved for disposal by their owner | You | Before collection |
| Serial-level handover | Exactly which devices and drives left, signed by both sides | You and vendor | At collection |
| Chain of custody log | Who held the devices at every step | Vendor, with your inputs | During the job |
| Erasure reports | Per-drive wipe result, method, verification | Erasure software via vendor | After processing |
| Destruction log | Per-serial physical destruction or degaussing | Vendor | After processing |
| Certificate of Destruction | Method and date for every serial, signed | Vendor | After processing |
| E-waste manifest and recycling certificate | Hardware moved and was recycled through an authorised channel | Vendor and authorised recycler | At collection and after processing |
| Reconciliation note | Register and certificates match; exceptions explained | You | After certificates arrive |
| Vendor due diligence file | The vendor's certifications, registrations and agreement | You | Before first job, refreshed yearly |
What an auditor actually does.
- Sample. The auditor picks five to ten assets marked retired in your register.
- Trace. For each one, you show the handover record and the certificate line with the same serial.
- Method check. They check the method suits the media. Degaussing an SSD, or a single overwrite on an SSD, is a finding.
- Sequence check. Destruction should be dated after collection and before any resale.
- Authority check. They check the vendor's registrations and certifications were valid on the job date.
- Exceptions. They ask what happened to anything that did not reconcile.
If you can trace every sampled asset in under a minute each, the control passes. If you have to phone the vendor, it usually does not.
Which rules touch IT disposal.
| Source | What it asks for, in plain terms |
|---|---|
| ISO/IEC 27001:2022 | Controls for secure disposal or re-use of equipment, and for deletion of information no longer required |
| NIST SP 800-88 Rev. 2 (2025) | Reference guidance on sanitisation methods (clear, purge, destroy) and on verifying and documenting them |
| DPDP Act, 2023 and DPDP Rules, 2025 | Reasonable security safeguards and erasure of personal data once its purpose is served; most duties apply from May 2027 |
| E-Waste (Management) Rules, 2022 | Bulk consumers must hand e-waste only to registered producers, refurbishers or recyclers |
| RBI Master Direction on IT governance (2023) | IT governance and information security expectations for regulated entities, tested by auditors |
Build your evidence pack.
Use a single spreadsheet as the spine of the evidence pack: one row per retired device, with the handover date, the certificate number and the disposition. Our free register template is built for exactly that.
Questions, answered.
Keep an evidence pack that links every retired device in your asset register to a destruction record: the signed serial-level handover, per-drive erasure reports or a destruction log, a Certificate of Destruction listing each serial, and a reconciliation note showing the register and certificates match, with any exceptions explained.
Usually not. Auditors test the link between your register and the certificate. Without the serial-level handover and a reconciliation, a certificate proves only that some devices were destroyed, not that yours were.
Typically by sampling. They pick a handful of assets marked retired in your register and ask you to trace each one to a destruction record, check the method suits the media type, and check the dates run in the right order.
At least as long as the related asset records, and as long as your audit, contract or regulatory obligations require. Your auditor or legal team should set the period in your disposal policy.
ISO/IEC 27001:2022 has controls for secure disposal or re-use of equipment and for information deletion. NIST SP 800-88 is the reference most vendors cite for sanitisation methods. India's DPDP Act, 2023 adds a duty to erase personal data once its purpose is served, and the E-Waste (Management) Rules, 2022 govern where the hardware goes.
Last reviewed 30 September 2026. Sources: ISO/IEC 27001:2022, NIST SP 800-88 Rev. 2, DPDP Rules, 2025 (PIB).
Want an evidence pack that passes first time?
We document the handover at your site and return certificates your auditor can check.
