Hard Drive Shredding for UK Businesses: When You Need It, and When Wiping Is Enough

The ICO's guide to data security is clear that the UK GDPR does not define the security measures you should have in place. It requires a level of security that is appropriate to the risks. For retired drives, that means you pick a method that matches how sensitive the data was, and you can show why.

Nothing there says shredding is mandatory, and nothing says wiping is always enough. The decision belongs to you, which is why the evidence behind it matters. See whether you legally need a certificate of data destruction.

• Erasure (wiping) overwrites or cryptographically clears the drive so the device can be reused. It suits drives that still work.
• Degaussing uses a strong magnetic field. It only works on magnetic media such as hard disks and tape.
• Shredding physically breaks the drive into fragments. It works on drives that have failed and cannot be erased.

NIST SP 800-88 groups these into three methods: clear, purge and destroy. NIST is a US federal standard, not UK law, but UK providers and procurement teams use it widely.

NIST published Revision 2 in September 2025. Several points affect how you choose a method:

• Multi-pass overwriting is not needed for the clear method. NIST says this counters the obsolete DoD 5220.22-M language.
• Degaussing should not be used on flash storage such as SSDs. A degaussing run can complete successfully while no sensitive data is sanitised.
• Destructive techniques may be the only option when a drive has failed or is obsolete and clear or purge cannot be applied.
• Pulverising and shredding should be avoided for anything but the lowest security categories of data, because as density and hardness of components increase, some destructive techniques can become ineffective.

That last point surprises many buyers, because shredding is often sold as the highest level of assurance. NIST's list of destroy techniques is disintegrate, incinerate, melt, pulverize and shred, and it warns that some of them become ineffective as the density and hardness of the media increase. Read our full breakdown in NIST 800-88 Rev 2: what it says about shredding, degaussing and multi-pass wipes.

The NCSC's guidance on secure sanitisation and disposal of storage media is aimed at UK organisations. It says its methods protect against standard users with commercially available recovery tools or forensic services, and are proportionate for OFFICIAL data. They will not protect data from a skilled, well-funded laboratory.

• For unencrypted media it describes overwriting the whole user-accessible space, and warns that remapped or bad sectors can leave data behind.
• Degaussing is for magnetic media only, and you must check that the degausser is strong enough.
• Physical destruction is to particles of 6mm or less, with the particle size verified afterwards.

The NCSC page was last reviewed in February 2025, before NIST published Revision 2, so expect it to change. Our reading is that the two do not conflict. They describe different adversaries and different data. Shredding to 6mm can be right for the second and insufficient for the first.

Cryptographic erase has conditions. NIST says it can only be used where no sensitive data has previously been stored in plaintext, and it should not be trusted where keys have been backed up or escrowed unless you are confident how they were managed. Switching encryption on for a drive that already holds data does not make it valid for that drive. That last sentence is our reading of the condition.

Once you have chosen destruction, the next question is where. Onsite shredding happens at your premises, so drives never leave your control in a readable state and your team can witness it. Offsite destruction happens at a secure facility after collection, which can suit sites where onsite access is not practical. Our decision guide compares them, and the onsite hard drive shredding service page explains how we run it.

Whatever method you choose, the certificate is your evidence. It should record:

• Each device, by serial number.
• The method used, and the standard it was carried out to.
• The date, and who carried it out.
• For physical destruction, the particle size, ideally verified.

A single batch certificate that lists no serial numbers proves little. See how to verify a certificate of data destruction.

Need hard drives destroyed? Call 0800 677 1344 or email services@nanosoftltd.com. We cover Essex, London and the rest of the UK.