A certificate of data destruction records four things against a single device: its serial
number, the method used, the standard that method was carried out to, and the date. A document
that covers a whole collection without naming each serial number is a form letter, not evidence.
It exists because destruction cannot be checked by looking at the hardware afterwards. Your
organisation remains the data controller under UK GDPR for whatever was on that device, so the
disposal has to be evidenced rather than simply arranged, and an ISO 27001 audit asks for exactly
this record under Annex A control 7.14.
What should be on it
- The device’s serial number, so the certificate can be matched back to a specific asset.
- The method used: which erasure software, or which shredding process.
- The standard that method maps to, usually NIST 800-88’s Purge or Destroy, and BS EN 15713:2023
for mechanical shredding. What each of those actually means is explained in full in our
guide
to the destruction standards. - The date, and who carried it out.
A single device gets the same certificate as a hundred of them, because there is no minimum quantity and the documentation works at the serial number level regardless of volume.
Two different processes, one certificate
| Outcome | Method | Standard | What’s recorded |
|---|---|---|---|
| Value recovered, hardware kept in use | Certus certified software erasure | NIST 800-88, Purge method | Serial number, erasure software, verification result, date |
| No value recovered, hardware destroyed | Mechanical shredding | NIST 800-88, Destroy method; BS EN 15713:2023 | Serial number, shred date, confirmation of destruction |
Certificate of data destruction, or WEEE evidence note?
They answer different questions, and both are produced on every collection. A certificate of
data destruction proves what happened to the data on a specific device. A WEEE evidence note
proves the equipment entered a licensed recycling and recovery chain, as required under the WEEE
Regulations. Neither substitutes for the other.
What Surplex UK Limited provides
Every collection produces a certificate of data destruction against each device serial number,
whichever method was used, alongside a WEEE evidence note for the collection. Collection and
destruction are carried out by our own BS 7858 vetted staff, with no subcontractors, across
England, Wales and Scotland. We are registered with the Information Commissioner’s Office under
number Z9955515, held since 2007.
Most customers find their collection is free, and there is no minimum quantity. Where the
recovered value does not cover the work, a small logistics and processing fee is payable, quoted
and agreed upfront.
Frequently asked questions
A serial number for each device, the method used, the standard it was carried out to, and the date. A certificate that covers a batch of equipment without naming each serial number cannot be matched back to a specific asset if it is ever queried.
Yes. Where value is recovered from hardware, data is erased with Certus certified software to the Purge method defined by NIST 800-88, and the certificate records the serial number, the software used and the verification result, in the same way a shredded drive’s certificate records the shred date.
A certificate of data destruction proves what happened to the data on a specific device. A WEEE evidence note proves the equipment entered a licensed recycling and recovery chain, as required under the WEEE Regulations. Both are produced on every collection, and neither can substitute for the other.
Yes. A single device gets the same certificate as a hundred of them, because there is no minimum quantity and the documentation works at the serial number level regardless of volume.
It is the evidence an ISO 27001 audit asks for under Annex A control 7.14, which requires verification that data has been removed before equipment is disposed of or reused, without prescribing a single method. What the control itself requires is explained in full in our ISO 27001 Annex A 7.14 guide.
For as long as the obligation it evidences lasts under your own data retention policy. Keep it against the device’s asset record rather than loose in an inbox, so it can be produced on request.
Focused Disposal & Data Security
Comprehensive IT Solutions
Get in Touch About Your IT Recycling Needs
We provide IT recycling services for organisations of all sizes across England, Wales and Scotland.
Whether you’re recycling a few old laptops, decommissioning a data centre, or need secure data destruction, our team will help you dispose of IT equipment compliantly and responsibly.
Prefer to speak with us directly?
Call: +44 (0)207 139 5175
Email: info@surplex.co.uk
Monday-Friday, 9am-5pm
