Branch desktops, ATM and kiosk PCs, core banking servers and storage, retired under your policy, with drives destroyed onsite if media may not leave the building.
PrivAce Technologies retires IT for banks and NBFCs across India: branch desktops, laptops, servers, storage and network equipment. Drives can be wiped, degaussed or shredded at your premises while your team watches, the job is covered by a certificate, and anything with resale value is paid for before pickup.
What is at stake
Why disposal needs care here.
Customer account data, KYC documents and loan files sit on branch desktops and shared drives long after a refresh. A single lost drive is a reportable incident and a reputational problem.
RBI’s Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, in effect from 1 April 2024) treats hardware and data as information assets under board-approved IT governance. It does not prescribe a disposal method, which is why most banks write their own media disposal standard and need a vendor who can follow it to the letter.
Rules that apply
The requirements behind a disposal policy.
Plain summaries with links to the source. Your legal and compliance teams decide how they apply to you.
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: Personal data on a retired device is still your responsibility. Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Most obligations apply from 13 May 2027.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 20 August 2024: Requires SEBI-regulated entities to have a data disposal and retention policy and to remove critical data from storage media using methods such as wiping, overwriting, degaussing, crypto-shredding or physical destruction.
PCI DSS v4.0, requirement 9.4.7: Electronic media with cardholder data must be destroyed, or the data made unrecoverable, when it is no longer needed.
ISO/IEC 27001:2022, controls 7.14 and 8.10: Control 7.14 covers secure disposal or reuse of equipment, and 8.10 covers deletion of information. Certified organisations need evidence for both.
What we do
How we handle it for you.
Onsite destruction for media that may not leave the branch or data centre
Erasure reports, and serial lists on request, to match your asset register
Multi-branch pickups coordinated as one job with one set of documents
Payment before pickup for equipment with resale value
Questions
Questions, answered.
Not in the 2023 Master Direction on IT governance. It requires board-approved governance of information assets, so the method is set by the bank’s own policy. We follow that policy, including onsite destruction.
Yes. We wipe, degauss or shred at your premises, your team witnesses it, and certificates are issued before we leave.
SEBI’s CSCRF of August 2024 applies to SEBI-regulated entities and explicitly requires removing critical data from storage media before disposal, by wiping, degaussing, crypto-shredding or destruction.
Yes. Multi-branch retirements are scheduled as one job, with one point of contact and one consolidated certificate set.
