In the past, privacy could be mostly ensured through paper shredding, but now data is almost universally digitized. It resides on hard drives, servers, disks, and, increasingly, in the cloud. The proper disposal of digital data can be a challenge for businesses. How can a business know when to destroy unnecessary digital data, and how to do it effectively?

Why destroy digital data?

There are several reasons an organization would need to destroy digital data, such as protecting customers and ensuring legal compliance.

1. Customer Protection

   Numerous security breaches happen every year that involve archived data.  If you no longer need the data, destroy it to avoid risking exposure of your customers’ private information.

2. Compliance

   In many circumstances, you may be required to destroy personal information. A majority of states in the US have enacted data disposal laws.  The growing trend is to enact consumer-focused protection laws.

   When determining how and when to destroy digital data, consider the basic types of data storage:

   • Physical.  This includes hard drives that can reside on servers and desktops.
   • Portable.  Any type of physical drive that is untethered from a computer, and includes USB flash drives, CDs, and zip drives.
   • Virtual cloud storage and applications. This includes customer data stored in cloud applications, such as Google Docs and Microsoft 365.

   It’s important to be aware of the different types of storage your organization uses.  If your goal is the complete deletion of sensitive files, then you must know exactly where all the data resides. Wiping a server drive clean, for example, doesn’t safeguard files if the original data files are sitting on an employee’s laptop or on a USB flash drive in a desk drawer.

When to remove data

Some of the reasons driving decisions to destroy digital data may also dictate the timing for completing the process.

1. Legal and regulatory compliance

   Professions have certain record-keeping requirements, sometimes keyed to statutes of limitation and other controlling rules. Other industries have best practices and other guidelines – such as insurance, medical, and IT security.

2. Other legal frameworks

   Privacy protection laws may compel data destruction. In addition to the several US state digital privacy laws, the global economy can impose additional requirements. For example, organizations doing business with EU citizens need to be mindful of the General Data Protection Regulation (GDPR) which goes into effect in 2018. This applies to many US businesses, such as those that offer products for sale globally. The GDPR gives people the right to demand that their data be “forgotten.” The trend is moving towards protection of privacy that is consumer focused and champions the rights of individuals.

3. Internal policies

   Your organization should develop its own set of data retention protocols, based on existing regulations but also cementing policies where no such guidelines exist. It should not be an afterthought, but a part of your business process. For example, remember that USB flash drive floating all over your office? A policy should be set for all organizations to handle the storage and treatment of portable files, otherwise, the risk is too great that the data can be compromised.

How to accomplish data destruction

As previously mentioned, it is imperative that your organization be aware of where all data resides. Accomplish this through policies that require files to be stored in one manner, such as on a server. If you securely and completely destroy data on your server, the job isn’t totally complete if an employee is walking around with file copies on a laptop and flash drives.  Once your policy is put into effect, here is how to go about digital data destruction:

1. Disposal

   This is dumping the data without sanitization and should be limited to non-confidential information. For a physical drive, this can be as simple as throwing the drive in an electronics recycling bin.

2. Clearing

   Overwriting data with patterns of numbers and symbols that effectively mask the underlying data. This can be done from your desktop or server’s operating system, or through third-party applications.

3. Purging

   A further step to magnetically erase data, it degausses the files, which is the process of removing magnetic data fields stored on disk media such as computer hard drives.  This works for other magnetic media such as diskettes, reels, cassettes and cartridge tapes. This is not 100 percent effective as the process will leave a small amount of residual data. Handheld degaussers are available as well as comprehensive degaussing and destruction appliances.

4. Destruction

   Physically destroying the media or hard drive renders it unusable and unreadable.  A simple example of this in practice is running a CD or DVD through a capable shredder.  Other examples would be incinerating a hard drive, or drilling its disk core.

5. What about the cloud?

   There are major concerns about how to incorporate data destruction into the cloud. This is important as almost all industries have migrated storage and computing to the cloud. This raises concerns because your organization does not possess the physical storage. In these cases, you must review your cloud service providers policies on data integrity and destruction and ensure that use of their services will be in compliance.

6. Disposition certificates

   This is one way to ensure compliance when your organization is either not in physical possession of the data, as in a cloud situation, or when you contract an outside organization to handle data destruction.

7. Hiring Professionals

   One of the best ways to ensure compliance and protect your data is to use a professional service provider to destroy data. These professionals have expertise in digital disposition, follow NIST standards, and can provide the appropriate disposition certificates. It is important to ensure that the outside company follows the appropriate procedures for your industry and your data destruction goals, but generally, they are up to speed on all of the changes and new technologies in data destruction and can help your organization maintain compliance.