Data Erasure vs Data Destruction: Which Does Your Organisation Need?

These two phrases get used interchangeably in ITAD quotes, and they are not the same thing. One leaves you with a working device and no data. The other leaves you with scrap. Choosing wrongly costs you either money or protection, so it is worth ten minutes to understand the difference.

The three levels, in plain English

The reference point most providers quote is NIST Special Publication 800-88, the United States guidance on media sanitisation. It is widely used in Australia because there is no local equivalent of the same depth. It describes three levels:

• Clear — overwrite the data using normal read and write commands, so ordinary recovery software cannot retrieve it. Suitable for a device staying inside your organisation.
• Purge — a stronger erasure that defeats laboratory recovery techniques. This covers approaches such as block erase, cryptographic erase and dedicated sanitise commands. This is the level you want before a device is resold or donated.
• Destroy — physically ruin the media so it can never store anything again: shredding, disintegration, incineration or melting. The device is gone, and so is its resale value.

In everyday use, "data erasure" usually means clear or purge, and "data destruction" means destroy. When a provider says "destruction" but describes software, ask which of the three they actually mean.

What changed in 2025

NIST published Revision 2 of SP 800-88 on 26 September 2025, replacing the 2014 edition. The headline change is one of emphasis: where Revision 1 gave device-by-device instructions, Revision 2 is about running a sanitisation programme, and aligns more closely with SP 800-53 and ISO/IEC 27040.

Two practical consequences. First, apart from cryptographic erase, Revision 2 points to external technical standards such as IEEE 2883 rather than specifying techniques itself. Second, the cryptographic erase guidance expanded considerably, including how encryption keys themselves must be sanitised.

If your provider is still quoting Revision 1 without knowing Revision 2 exists, that tells you something about how closely they follow the field.

What Australian law actually requires

The Privacy Act does not mandate a particular erasure technique. Australian Privacy Principle 11.2 requires that when you no longer need personal information for a permitted purpose, you take reasonable steps to destroy it or ensure it is de-identified.

Three points from the OAIC guidance are worth holding onto:

• The obligation covers every copy you hold, including archives and backups. The decommissioned backup server counts.
• Destruction means the information can no longer be retrieved. Where hardware can be sanitised, sanitising it satisfies this. Where it cannot, the data has to be destroyed another way.
• If you instruct a third party to destroy data, reasonable steps include verifying that it happened.

That last point is the one organisations miss. Handing devices to a recycler and assuming is not a reasonable step. A certificate that names the serial numbers and the method is.

So which do you need?

Erasure is usually the right call when: the device still works and has resale value; it is standard business equipment such as laptops, desktops or phones; the data was ordinary commercial or personal information rather than classified material; and you want to recover some of the cost of your refresh.

Destruction is the right call when: the drive has failed and cannot be verifiably erased; the data is highly sensitive, such as health records, legal files or government information; your own policy or a contract requires physical destruction; or the device is obsolete enough that it has no resale value anyway.

A good ITAD partner will do both in one job: erase what can be resold, destroy what cannot, and give you a single record covering the lot.

The failure case to plan for

Erasure does not always succeed. Drives fail mid-wipe. Some older media does not support the sanitise commands. Occasionally a device simply will not report back.

Ask your provider what happens then. The right answer is that any device failing verification is physically destroyed and recorded as destroyed. The wrong answer is silence, because a drive that failed erasure and went to resale anyway is exactly how data walks out the door.

Why this is showing up more often

The OAIC recorded 532 notifiable data breaches between January and June 2025. Malicious or criminal attacks caused 59 per cent of them, but human error caused 37 per cent — up from 29 per cent in the previous six months.

Human error is the category that disposal decisions fall into. Nobody plans to leak a patient list through a traded-in laptop. It happens because a process had a gap in it.

What to ask for

Whichever route you choose, insist on documentation that names the method per device, lists serial numbers, records the verification result, and is signed and dated. NIST calls this a Certificate of Sanitisation; most Australian providers call it a Certificate of Destruction. The label matters less than the content.

ReSource erases to NIST 800-88 standards and physically destroys anything that cannot be verifiably wiped, with a Certificate of Destruction issued for every job. You can read more about our data destruction service or our wider ITAD services.

‍