Delete and destroy data

Why a Delete Operation Isn’t a Final Deletion

Operating systems delete fast, not thoroughly. They remove the entry from the file system's directory and free up the space for reuse. The actual content stays put until something else overwrites it, and until then it can be recovered with freely available tools.

Germany's Federal Office for Information Security (BSI) describes exactly this in its IT-Grundschutz framework, and draws a second conclusion from it: only an entire storage medium can be reliably wiped. For individual files, it only works to a limited extent.

On top of that comes everything you never see during normal use:

• deleted files where only the directory entry was removed
• unallocated file fragments
• remapped or defective sectors
• older versions of files
• hidden or system-protected files

GDPR Data Deletion: Is a Factory Reset Enough?

During a reset, Windows reinstalls itself. Microsoft does not document any guarantee that the previous data can no longer be reconstructed afterwards. For unencrypted, rewritable storage media, the BSI therefore requires a full overwrite with a stream of random values.

So for company devices, don't rely on a factory reset. The safe route is deletion software where you choose the algorithm to match the specific storage medium.

If the device was fully encrypted throughout its life, the picture changes. In that case, the reset destroys the key material, and the data on the drive becomes worthless without the key. That's how "Erase All Content and Settings" works on Macs with Apple silicon or a T2 chip, and it's also what the BSI specifies for smartphones and smart devices: encrypt, reset, then complete the setup process once. One limitation remains, and it applies to any cryptographic erasure: if a copy of the key exists anywhere, the data can be recovered.

Data Deletion on SSDs: Why Overwriting Misses the Mark

On a classic hard drive, an overwrite lands exactly where the old data sits. An SSD, by contrast, manages its own storage. The controller decides which memory cell something gets written to, and it keeps reassigning that mapping. That's why simple overwriting never reaches the entire memory of an SSD. There are three reasons for this:

• The SSD spreads write operations evenly across all cells so none wears out prematurely. The new content lands somewhere else; the old content stays where it was.
• Part of the memory is held back as reserve and isn't reachable from the outside.
• Worn-out cells get quietly taken out of service by the SSD, content and all.

The US standards body NIST draws a clear conclusion from this in its sanitization guidelines: what needs to be wiped is the entire physical memory of an SSD, not just the part the operating system can see. The current version of that guideline dates from September 2025.

This also affects the triple-overwrite rule still found in many internal policies. It comes from a US Department of Defense directive (DoD 5220.22-M) from the era of classic hard drives, and it has not been maintained as its own standard since 2021. The NIST guideline does not work with multiple overwrite passes at all, but with the drive's own erase commands and cryptographic erasure. What matters, then, is not how many times something is overwritten, but whether the method reaches the entire memory.

Two Methods That Work on SSDs

1. The SSD erases itself

The deletion software sends a command to the storage medium, and it takes care of the rest. Because it knows its own memory, it also reaches the reserve areas and the cells taken out of service. The drive reports back whether the process completed. That confirmation belongs in the deletion log.

1. The key is destroyed‍

‍If the storage medium was encrypted throughout its life, it's enough to delete the key. After that the content can no longer be read, and it takes seconds rather than hours. Two conditions decide whether this method holds up. The data must never have sat unencrypted on the storage medium, and there must be no copy of the key anywhere, including in a key management system or an escrow.

Deletion Methods Compared: HDD and SSD

Conditionally suitable means: the method only holds up as long as no copy of the key exists anywhere.

Certified Data Deletion: 3 Signs of a Reliable Provider

What Belongs in a Deletion Log

Art. 5(2) GDPR requires that you can prove compliance. A deletion without documentation is just a claim. NIST describes a deletion certificate in SP 800-88 Rev. 2, and its required fields double as a checklist:

• manufacturer, model and serial number of the storage medium
• media type
• method applied and the specific technique
• deletion software used, including version
• verification method and result
• date and duration of the deletion

Ask to see a sample before you place an order, and check whether the log is kept per storage medium or only per shipment.

How to Read the Word “Certified”

Ask about the certification body, the scope, and the certificate number. This is where providers who keep real evidence part ways from providers who just put a logo on their site. That goes for the deletion method as much as for shredders and logistics partners.

BSI-Compliant or BSI-Approved

The two get mixed up regularly, and not always by accident:

• BSI-compliant means a method meets the requirements of the BSI's IT-Grundschutz framework, derived from how sensitive the data is. The provider documents this themselves.
• BSI-approved evaluates the security features of a specific product for a defined scope of use. The BSI applies this mainly to IT security products that protect classified information.

For public authorities and public-sector organizations handling classified material, this distinction decides whether a provider is even eligible for the contract. Anyone claiming an approval should be able to prove it. How we handle public-sector clients is covered under selling used hardware as a public-sector organization.

Defective Storage Media: A Case for Destruction

Every deletion method assumes a drive that still accepts commands. If the controller fails, the data is still there. The BSI explicitly flags the warranty-return case in the threat description for module CON.6 of the IT-Grundschutz framework: a drive with a defective controller goes back to the manufacturer, gets wiped quickly and insecurely there, and ends up back on the market.

That leaves physical destruction, and it has to reach the right security level. Partial damage from drilling or cutting isn't enough, because parts of the surface can still be read. You can find out which level which material needs in our article on destroying storage media under DIN 66399. And for handling entire fleets, see our article on disposing of hard drives in a company.

Responsibility Stays with the Data Controller

Outsourcing the deletion doesn't outsource the responsibility. You remain the controller under the GDPR; the service provider becomes a processor under Art. 28. Three obligations follow from that, and they come up regularly in audits:

• a contract under Art. 28(3) that governs deletion or return once the engagement ends
• a documented selection decision that checks the provider's methods against your own requirements
• regular checks on whether the process still runs the way it was agreed

What happens when that chain breaks was put a number on by the US Securities and Exchange Commission in 2022. Morgan Stanley had handed the decommissioning of thousands of hard drives and servers to a moving and storage company with no experience in data destruction.

The devices were resold and ended up with customer data on an auction platform; around 15 million customers were affected, and most of the devices were never recovered. The fine came to US$35 million. The drives had an encryption feature – it just hadn't been switched on for years.

The case falls outside the GDPR, but the causes translate directly: an unsuitable provider, no oversight, no encryption, no inventory reconciliation. The 42 missing servers only surfaced during a stock check.

Delete Instead of Shredding

Many companies destroy storage media as a blanket policy, even when the drives still work. Given how prices for RAM and SSDs have moved, that's become an expensive precaution – you can read more about this in our article on the 2026 storage shortage.

Compared with a properly performed and logged deletion, destruction adds no extra protection. The standards reserve it for cases where no deletion method still applies. NIST assigns destruction to storage media that can no longer be reliably wiped, and the BSI requires at least security level 3 under ISO/IEC 21964-2 for defective storage media.

Refurbishment conserves resources by reusing rather than discarding (source: Fraunhofer UMSICHT / Interzero; Rittershaus et al., 2026, DOI: 10.1002/bse.70271). What you need to be able to back up such claims with since September 2026 is covered in our latest article on the EmpCo Directive.

How GDPR-Compliant Data Deletion Works at Econocom Remarketing

Every device that comes in first goes through auditing and classification, then data deletion. Only after that does refurbishment begin. Our own software, SAM, automatically detects every storage medium in the device, from the SIM and smart card to the internal hard drive. Deletion runs on Blancco.

We then reconcile our database fully automatically against the Blancco database, using the storage medium's serial number. No deletion is checked by hand, since that's exactly where mistakes creep in. You receive a tamper-proof, digital deletion log.

If a storage medium can't be wiped, we destroy it in-house. You can find the full process under professional IT refurbishment, and our safeguards at the technology center under data security.