Any organisation that processes personal data is subject to the General Data Protection Regulation (GDPR). This obligation does not cease when a laptop or server is written off. As long as there is data on a device, you remain responsible for that data. In this article, you can read about what the GDPR means for the disposal of hardware and how you can demonstrate that you have made the necessary arrangements.
What does the GDPR say about the destruction of data?
The GDPR does not specify a particular method of destruction, but it does set out clear requirements. Personal data must be adequately secured, including against unauthorised access and loss (Articles 5 and 32). Furthermore, you must not retain personal data for longer than is necessary. A decommissioned hard drive containing old customer data does not meet either of these requirements.
In addition, there is an obligation to demonstrate compliance: you must be able to prove that you comply with the GDPR. It is therefore not enough simply to destroy data; you must also be able to prove that you have done so.
What happens if things go wrong?
If an old laptop or hard drive containing personal data is lost, or falls into the wrong hands without having been wiped, this constitutes a data breach. In many cases, you must report such a breach to the Dutch Data Protection Authority within 72 hours. The GDPR provides for fines of up to €20 million or 4% of global annual turnover. The damage to your reputation is at least as great when customers learn that their data has been found on a second-hand device.
Four steps to GDPR-compliant data destruction
1. Make an inventory of your data storage devices
Think beyond laptops and servers. Smartphones, tablets, USB sticks, backup tapes, NAS systems, printers and network equipment may also contain data.
2. Choose the right method
Functioning devices can be certified as wiped – for example, using Blancco software – so that they can then be reused. Faulty data storage media or highly sensitive data should be physically destroyed using a shredder in accordance with the DIN 66399 standard. Read more about the various methods on our page about data destruction.
3. Secure the chain
The risk lies not only in the destruction itself, but also in the process leading up to it. Where are the devices stored until they are collected? Who transports them and how? Reuzado uses its own drivers and locked roll-on/roll-off containers, and registers every data carrier on arrival. If you want the data to remain on the premises at all times, choose on-site data destruction.
4. Make a record of everything
Ensure you obtain a certificate of destruction, including serial numbers and the date for each data carrier, and keep this in your records. If you engage an external party, make sure you set out the arrangements regarding data processing in writing. After all, that party is processing your personal data.
What should you look out for when choosing a supplier?
- Does the organisation operate in accordance with recognised standards, such as ISO 27001 and DIN 66399?
- Do you receive a certificate on a data storage medium, with a serial number?
- Is the transport secure and traceable?
- Can you track and retrieve the processing history, for example via a customer portal?
Reuzado operates in accordance with ISO 27001 and DIN 66399, is a Blancco ITAD Gold Partner and provides a certificate for each data carrier via the Circu-IT customer portal. This means you have everything to hand straight away in the event of an audit.
Would you like to know how to dispose of your end-of-life IT equipment in a GDPR-compliant manner? Take a look at our approach to data destruction or request a no-obligation quote.
Frequently asked questions
Does the GDPR prescribe a specific method of destruction?
No. The GDPR requires appropriate security measures and that you can demonstrate compliance with the regulations. Recognised standards such as DIN 66399 and certified data erasure software help you to demonstrate this.
Do I need to report a lost or undeleted laptop?
If it contains personal data and that data could fall into the wrong hands, this constitutes a data breach. In many cases, you must report such a breach to the Dutch Data Protection Authority within 72 hours.
How long should I keep a data destruction certificate?
Keep the certificate in your records for as long as you need to be able to demonstrate what has happened to the data. Consult your data protection officer or legal adviser to agree on the exact timeframe.