Data Destruction Policy

Introduction

A data destruction policy is a set of written principles that guide how to properly dispose of information and the mode of disposal for each data category. The hardware disposal and data destruction policy aims to protect data from unauthorized access by controlling who gets to handle the disposal process.

As the world gets more connected and information is churned at record levels, having a sound destruction policy protects your business from potential risks. Data is the new gold and can easily be weaponized against your company’s reputation or revenues.

Data Destruction Policy – Overview

A data destruction policy protects an organization, its employees, clients, vendors, and any other persons that interact with them. The policy’s purpose is to protect personal information from unauthorized usage and distribution.

As organizations rely on data from customers and clients to stay competitive in their industries, it has become increasingly vital to enforce data regulation policies.

A hardware disposal and data destruction policy provides guidelines to remove and dispose of data no longer useful to the business.

The GDPR data destruction policy (General Data Protection Regulation) governs how personal data is processed and destroyed by organizations. These regulations have been applied among EU countries and customized to member state requirements.

Why Should we Implement Data Destruction Policy?

Failure to implement a data destruction policy opens up a business to potential risks that can damage a business’s reputation and operations.

A data destruction policy creates layers of protection for sensitive data and defines the destruction process for irrelevant data. A policy also provides safe guidelines to sort and remove unnecessary information to make room for storing the most relevant data.

As companies acquire newer hardware, it’s essential to create a hardware disposal and data destruction policy. The policy should outline how the organization will manage end-of-life equipment, dispose of e-waste, and best practices in line with environmental regulations.

A data destruction policy also outlines data backup schedules and the backup method to be applied.

Data Destruction Policies

One of the most popular legislation that governs data destruction is the European Union’s General Data Protection Regulation (GDPR). This policy lays down the rules that govern the protection and processing/destruction of personal data. In addition, the GDPR also outlines penalties for violation of their policies which adds up to 4% of a company’s total turnover.

The specific clause that applies to hardware disposal and data destruction policy is the Right to be Forgotten rule. This rule regulates data erasure and destruction. It states that personal data should be destroyed immediately when that information is no longer useful for the original purpose it was acquired for, or the person has chosen to withdraw their consent and, there is no other legal justification for processing the data. It also states that the data must be deleted if the data owner has withdrawn their desire to provide their data and there are no legitimate reasons to continue using their data. Destruction may also be done to fulfill a statutory commitment under the European Union legislation or Member States. Additionally, this data must be destroyed if the initial processing was against the rules.

In 2020, Canada introduced a bill to enhance the existing data privacy legislation. Canada’s federal government introduced Bill C-11, An Act to implement the Personal Information and Data Protection Tribunal Act (PIDPTA) and the Consumer Privacy Protection Act (CPPA). Once approved, CPPA will replace PIPEDA (Personal Information Protection and Electronic Documents Act) to become the active privacy law in Canada.

The CPPA enhances the regulator’s power. For example, authorized officials under CPPA will have a right to audit a company’s privacy policies.

The CPPA will have a rule equivalent to the GDPR data destruction policy provision of “Right To Be Forgotten” that governs data erasure and destruction.

Below is a data destruction policy example:

Data Destruction Policy

Destroy customer, client, and employee data if it is no longer useful to the business. The data destruction should not conflict with the data retention policies that affect customer data, legislation obligations, or any ongoing legal action.
The media below is prohibited from storing confidential company information. This rule applies to all employees, vendors, clients, and contractors. USB flash drives

Hard disk drives and solid-state drives
CD/ DVDs
Paper media e.g., printed documents
Cloud-based storage

All cloud-based storage technology that’s no longer in use should be audited and sanitized. In addition, all data contained should be backed up and protected.
Computer storage media such as laptops and desktops should not be sold or donated without prior sanitization to clear all data from the devices.

HIPAA Compliant Data Destruction

The HIPAA compliant data destruction privacy rule requires businesses to adhere to specific principles and guidelines when disposing of computer hard disk drives that contain Electronic Protected Health Information (EPHI). Healthcare practitioners must create safeguards to protect electronic Protected Health Information. Examples of Electronic Protected Health Information include:

A patient’s lab tests and results
Medicine subscriptions
X-rays, MRI, and medical photographs of patients
Patient’s medical information stored in electronic devices

Below are the guidelines for disposing of health-related confidential information:

Electronic media that contains Electronic Protected Health Information must be rendered unusable or inaccessible once it serves its purpose. One way to do this is to physically destroy the device to make the data unreadable and inaccessible.
Healthcare providers should record the receipt and removal of electronic hardware that contains electronic Protected Health Information.
All electronic media coming into or leaving a healthcare provider’s custody should be properly recorded and reported.
A contract or an agreement should be created for businesses that provide data destruction services to healthcare providers. The contract should clearly state privacy requirements and action to be taken in case of a data breach.
Electronic Protected Health Information should always be in the custody of an authorized staff member of the healthcare entity and should always be supervised.

Data Removal Classification

Data removal is classified into three distinct techniques that help you decide what data destruction method to apply.

These are:

Clearing

This is the simplest form of data removal. This involves overwriting the existing data or resetting the device to factory settings.

Purging

Data purging renders information unreadable and cannot be recovered even within a laboratory environment. This classification works with methods such as degaussing and cryptographic erasure to purge data from storage devices.

Destroying

Data removal by destruction shreds data and the containing storage devices. This classification works with techniques such as physical shredding, pulverization, and incineration. Data destruction renders data unreadable and unrecoverable and is ideal for handling sensitive information. Destruction is also used on end-of-life devices that are no longer useful.

Data Destruction Techniques

These data destruction techniques should be included in the hardware disposal and data destruction policy.

Deleting

Deleting files removes them from the containing folder but does not delete the data permanently. Deletion is a simple method that works for simple, non-sensitive data.

Degaussing

Degaussing is the permanent removal of data from storage devices using high-energy magnetic fields to destroy data on magnetic tapes. This technique destroys data rendering it unrecoverable.

Incineration

This method involves melting solid-state drives in high-temperature incinerators to ensure data and the storage device is destroyed.

Data Shredding

Shredding removes the data without destroying the storage hardware. This works by overwriting data with random numbers to render the original data unreadable.

Cryptographic Erasure

This technique uses encryption software that destroys the key used to decrypt data. This makes it impossible to retrieve the data because the original decryption key has been destroyed.

Data Destruction Best Practices

Below are the recommended best practices for data destruction:

Involve all departments while creating your data destruction policy. For example, create a team represented by a staff member from each department. This approach makes the policy creation process easier, and you get buy-in from all departments.
Create and implement a data destruction schedule.
In your data destruction policy, outline a data destruction process that highlights the steps, procedures, and data destruction methods to be applied. Also, indicate who is in charge of the data destruction process.
Set aside time to test and pilot the data destruction process before implementing it across the organization.
Review vendor agreements, employee contracts, and any other relevant agreement to ensure data destruction does not violate any clause within those agreements.
Monitor and adjust your data destruction process regularly. Your data destruction policy should evolve as your company grows and as new legislation comes up.
Use metadata technology to simplify the search process for files and folders within your storage systems.

Benefits of a Data Destruction Policy

A data destruction policy is a necessary tool to have for managing your data processes smoothly. Below are the benefits of a data destruction policy:

A data destruction policy outlines a data removal schedule to free up storage space. The destruction process can easily be automated when you clearly outline which data should be retained and destroyed.
The policy prevents accidental erasure of important data. In addition, due to the rules included in the policy governing data handling, the policy will prevent accidental erasure or tampering with sensitive data.
There is accountability in how data is handled. In case of data breaches, a policy will protect all parties involved and expose the data breach source.
When you know and highlight laws and regulations that apply to data destruction, a company stays informed while avoiding lawsuits in case customers raise complaints about their data.
Unnecessary data is removed swiftly from your storage systems allowing for easier access to information. Employees do not have to sort through raw data to get important information.
You reduce the cost of purchasing more storage devices by deleting data regularly.
Data destruction policies protect companies from competition who could use old data against you. In addition, regularly destroying data protects your company’s former employees and customers from hackers and identity theft.
You protect your company from fines and penalization when you comply with data laws and regulations.

For more information on how to destroy your data safely and securely, contact TechReset for an appointment.

Electronic Waste Disposal & Management – What All Is Involved In The Process?

In contrast to what one might believe when coming across the expression “e-waste disposal”, disposing of electronic waste – in the most environmentally friendly manner,

Don’t Ignore a Cash Return on Your Older IT Assets

The question we often ask at TechReset is: How can we educate companies on the money they may be leaving on the table when they

Data Destruction Policy

Introduction

Data Destruction Policy – Overview

Why Should we Implement Data Destruction Policy?

Make an Informed Decision