# Data Sanitization Services India | NIST SP 800-88 | PrivAce

> Data sanitization for corporate IT: clear, purge or destroy under NIST SP 800-88, with a certificate per device.

Source: https://privace.in/services/data-sanitization/

---

[Home](/) › [Services](/services/) › Data Sanitization

NIST SP 800-88 · Clear, Purge, Destroy

# Data Sanitization.

The umbrella term for every method of permanently removing data, and the framework for choosing the right one.

[Get a Free Valuation](/contact/)

Speak to an expert

The short answer

**Data sanitization is the permanent removal of data from storage media so it cannot be recovered by any known technique, including laboratory methods.** NIST SP 800-88 defines three categories, Clear, Purge and Destroy, and the right one depends on the sensitivity of the data and whether the device will leave your control.

It is the umbrella term, not a single method. Software erasure, cryptographic erase, degaussing and physical destruction are all forms of sanitization.

## Clear, Purge, Destroy, and How to Choose.

Most policies say “sanitize all media before disposal” and stop there. The category you choose is the whole decision.

| Category | What it does                                                               | Protects against           | Device survives                           |
|----------|----------------------------------------------------------------------------|----------------------------|-------------------------------------------|
| Clear    | Verified overwrite through standard interfaces                             | Ordinary recovery software | Yes: value retained                       |
| Purge    | Secure-erase or cryptographic-erase command; degaussing for magnetic media | Laboratory recovery        | Yes for erase commands; no for degaussing |
| Destroy  | Shredding, disintegration, incineration                                    | Everything                 | No                                        |

The three NIST SP 800-88 sanitization categories compared.

**A practical rule.** If the device stays inside your organisation, Clear is usually sufficient. If it leaves your control, resale, donation, disposal, Purge is the sensible floor. If the media held regulated, financial, health or customer personal data, or if it has failed and cannot be verified, Destroy.

The category also decides whether you recover any money. Clear and the erase-command form of Purge leave a working drive with resale value. Degaussing and destruction do not.

## Why SSDs Break Most Sanitization Policies.

A policy written for hard disks and applied unchanged to a modern laptop fleet is the most common failure we see, and it is worth being precise about why.

A hard disk stores data magnetically at fixed physical locations. Write to logical sector 4,096 and you overwrite the physical spot holding the old data. A conventional overwrite therefore reaches everything.

**SSDs and NVMe drives do not work that way.** Their controllers use wear levelling to spread writes across physical flash cells and extend the drive’s life. A write to logical sector 4,096 may land on a completely different physical cell than the one holding the old data, so an overwrite can report success while fragments survive in cells it never reached, including over-provisioned space the operating system cannot even see.

The correct methods for solid-state media are the drive’s own **secure-erase** or **cryptographic-erase** command, issued through software that knows how to invoke it, or [physical destruction](/services/hard-drive-shredding/). An HDD-era overwrite applied to an SSD fleet is not equivalent, however confidently it reports completion.

Also worth noting: [degaussing does nothing to an SSD](/services/degaussing-services/). It destroys data by collapsing a magnetic field, and flash memory has none.

## On DoD 5220.22-M.

You will see DoD 5220.22-M cited constantly in Indian data destruction marketing, usually as a three-pass or seven-pass overwrite. It is worth knowing where that stands.

**It is not a current sanitization standard.** The pattern originated in the US National Industrial Security Program Operating Manual, and the Defense Security Service stopped specifying overwrite patterns for classified media more than a decade ago. NIST SP 800-88 superseded it as the working reference, and its central finding is that **for modern drives a single verified pass is sufficient**: the multi-pass patterns were designed for drive technologies no longer in production.

We reference NIST SP 800-88 and we do not claim DoD 5220.22-M. If a vendor leads with it, it is a fair question when they last reviewed their process, and a fairer one whether they know the difference between an overwrite and a verification.

## How We Apply It.

1

### Classify the media

Every device sorted by type, magnetic, solid-state, tape, optical, because the method depends on it. Mixed batches are separated before anything starts.

2

### Match category to sensitivity

Clear, Purge or Destroy, agreed with you against your policy and the data the device held. We write it down before the job, not after.

3

### Apply and verify

Licensed erasure software where the drive survives; degaussing or shredding where it does not. Verification where the method allows it, and the drive flagged for destruction where it fails.

4 Document Erasure report per wiped drive (serial, method, date, result), or a destruction certificate for the batch.

This is what an auditor asks for, and it is the only part that exists after the work is done.

Coverage

## Where We Provide This.

We serve 497 cities across India. Mumbai, Navi Mumbai, Thane and Pune are our regular-pickup markets with scheduled routes and free collection; everywhere else is assessment-and-quotation, with an identical destruction process and identical documentation.

[Mumbai service areas](/service-areas/) [All 497 cities](/cities-we-serve/)

Related

## The Methods in Detail.

### Certified Data Wiping

Software erasure: the Clear and Purge categories in practice.

[Learn more](/services/certified-data-wiping/)

### Degaussing Services

Magnetic Purge for hard disks and tape.

[Learn more](/services/degaussing-services/)

### Hard Drive Shredding

The Destroy category, for every media type.

[Learn more](/services/hard-drive-shredding/)

### Certified Data Destruction

The full service and its documentation.

[Learn more](/services/certified-data-destruction/)

Questions

## Data Sanitization, Answered.

### What is data sanitization?

Data sanitization is the process of permanently removing data from storage media so that it cannot be recovered by any known technique, including laboratory methods. NIST SP 800-88 defines three categories:**Clear**, **Purge** and **Destroy**: each offering a different level of assurance. The term covers software erasure, cryptographic erase, degaussing and physical destruction; it is the umbrella, not a single method.

### Is data sanitization the same as data destruction?

Not quite, and the distinction matters when you are writing a policy. Data sanitization is the broader term: it includes methods where the device survives and stays usable. Data destruction usually implies the device does not survive. Every act of data destruction is sanitization; not every act of sanitization is destruction. If your policy says “sanitize”, you have more options than if it says “destroy”.

### What is the difference between Clear, Purge and Destroy?

**Clear** applies logical techniques through the device’s standard interfaces, a verified overwrite, and protects against ordinary recovery tools. **Purge** applies stronger methods such as the drive’s own secure-erase or cryptographic-erase command, or degaussing, and protects against laboratory recovery. **Destroy** physically renders the media unusable. The right category depends on the sensitivity of the data and whether the device will leave your control.

### Does sanitization work differently on SSDs?

Yes, and this is where most policies fail. Hard disks store data at fixed physical locations, so a conventional overwrite reaches everything. SSDs use wear levelling to spread writes across flash cells, so an overwrite can report success while data survives in cells it never reached, including over-provisioned space the operating system cannot see. For solid-state media the correct routes are the drive’s own secure-erase or cryptographic-erase command, or physical destruction.

### What documentation do we receive?

A record tied to the device serial number stating the method applied, the category under NIST SP 800-88, the date, and whether verification passed. Where software erasure is used you receive the tool-generated erasure certificate; where media is physically destroyed you receive a Certificate of Destruction; where hardware is recycled you also receive the Form 6 E-Waste Manifest and Certificate of E-Waste Recycling.

### Can sanitization happen at our premises?

Yes. For organisations whose information security policy forbids media leaving site, we bring the equipment to you, your team witnesses the process, and the certificates are issued before we leave the building. Otherwise media is packed and processed under documented custody at our parent company’s MPCB-authorised facility.

### Which standard do you follow?

NIST SP 800-88, *Guidelines for Media Sanitization*, now in Revision 2 (September 2025). We do not claim DoD 5220.22-M, which is frequently cited in Indian vendor marketing despite having been superseded: the DoD itself no longer maintains it as a sanitization standard. If a vendor leads with DoD 5220.22-M, it is worth asking when they last reviewed their process.

### Do you only operate in Mumbai?

No. We serve 497 cities across India. Mumbai, Navi Mumbai, Thane and Pune are our regular-pickup markets with scheduled routes and free collection; everywhere else is assessment-and-quotation, with an identical destruction process and identical documentation.

Last reviewed 30 September 2026. References: [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final), [DPDP Act, 2023](https://www.meity.gov.in/data-protection-framework).

## Which Category Does Your Policy Need?

Tell us what media you have and what your policy says. We will tell you which category applies, and say so if it is the cheaper one.

[Get a Free Valuation](/contact/) [Get a buyback valuation](/sell-your-old-it-assets/)

Written by [Anant Verma](/team/#anant-verma), PrivAce Technologies · Reviewed by [Ajmal Khan](/team/#ajmal-khan) (Head of Strategy and Operations) · Last reviewed 30 September 2026