Data erasure standards: NIST 800-88, GDPR, HIPAA & ISO 27001
When a drive leaves your control, the question isn't "did you delete the files?" — it's "can you prove the data is unrecoverable?" That's what data erasure standards are for.
Data erasure standards answer a simple question: how thoroughly must data be removed, and how do you prove it? They differ in the terminology they use, but they converge on the same idea — that erasure has to be verifiable, not just performed.
In this series:
- NIST 800-88: Clear, Purge & Destroy explained
- GDPR and the right to erasure
- HIPAA data disposal
- ISO 27001 information deletion
What is NIST SP 800-88?
NIST Special Publication 800-88 Revision 1, "Guidelines for Media Sanitization," is the most widely referenced framework for erasing storage media. It defines three outcomes, in increasing order of confidence:
| Outcome | What it means | Typical technique |
|---|---|---|
| Clear | Protects against basic, non-invasive recovery — makes data infeasible to recover using standard tools. | Overwrite, ATA Secure Erase, NVMe Format |
| Purge | Protects against laboratory recovery — renders data unrecoverable even with specialised equipment. | ATA Enhanced Secure Erase, NVMe Sanitize (crypto/block), Cryptographic Erase |
| Destroy | Renders the media unusable — data is unrecoverable because the media itself no longer functions. | Shredding, disintegration, incineration, degaussing |
The key distinction is Clear vs Purge. Clear is fine for drives being redeployed inside your own organisation. Purge is what you reach for when a drive is leaving your control — resold, returned, recycled, or sent for repair — because it holds up against a motivated attacker with lab equipment.
How tScrub maps methods to outcomes
tScrub classifies every drive and picks the strongest method the hardware supports, then records the outcome in the report. For example:
- NVMe Crypto Purge → Purge
- ATA Enhanced Secure Erase → Purge
- ATA Secure Erase → Clear
- Software overwrite (SCSI fallback) → Clear
- Frozen or blocked drive → Destroy (flagged for physical destruction)
The full method-to-outcome mapping is on the compliance page.
GDPR and the right to erasure
Under UK GDPR and EU GDPR, individuals have a "right to erasure" (the right to be forgotten). For organisations that hold personal data on drives, that means when a device is decommissioned, the data must be rendered unrecoverable — and, crucially, you should be able to demonstrate that you did so.
A signed, auditable erasure report is the practical way to satisfy that burden of proof. It shows which drives, when, how, and that the method matched the sensitivity of the data.
HIPAA and the disposal of protected health information
The HIPAA Security Rule requires covered entities and business associates to dispose of electronic protected health information (ePHI) in a way that it cannot be reconstructed. The US Department of Health & Human Services explicitly cites clearing, purging, and destruction of media as compliant approaches.
For healthcare organisations, that makes a per-drive record — including pre-wipe SMART health — valuable evidence that a specific serial-numbered drive was handled correctly.
ISO/IEC 27001 and information deletion
ISO/IEC 27001:2022 addresses erasure through Annex A control 8.10, "Information deletion", which requires that information be deleted when no longer needed, in a way that considers legal and contractual requirements. Supporting guidance points to sanitisation of media before disposal or reuse.
In an ISO 27001 audit, the question will be the same as everywhere else: show me the evidence. A chain-of-custody report with a certificate of destruction is exactly the kind of record auditors expect.
DoD 5220.22-M and the multi-pass myth
You'll still see "DoD 5220.22-M 3-pass" or "7-pass" wipes advertised. The original DoD 5220.22-M standard is long obsolete, and multiple overwrite passes have been unnecessary for modern drives for years — on a healthy drive, a single overwrite pass is generally sufficient, and firmware-based erasure (Secure Erase or Sanitize) is faster and more complete, because it also reaches areas the operating system can't see, such as reallocated sectors and the over-provisioned area on SSDs.
The practical takeaway: choose a firmware method first, and fall back to software overwrite only where the drive doesn't support one.
Which standard applies to you?
| Sector | Typical driver | Recommended outcome |
|---|---|---|
| Financial services | FCA / PRA, contractual data-handling rules | Purge, with signed reports |
| Healthcare | UK GDPR, NHS requirements, HIPAA (US) | Purge, with per-drive audit trail |
| ITAD & refurbishers | Client contracts, data-protection law | Purge before resale; certificate per batch |
| General business | UK GDPR / GDPR | Clear for reuse, Purge on disposal |
FAQ
Is overwriting a drive enough?
For Clear it can be, but firmware methods (Secure Erase, Sanitize) are preferred — they're faster and cover areas software can't reach. On SSDs, overwriting is both less complete and harder on the flash.
Do I need to destroy every drive?
No. Destruction is only required when erasure isn't possible — for example, a drive that's failed, frozen, or physically damaged. Erase where you can, destroy where you can't.