A certificate of data destruction is the document that proves your business wiped or destroyed data-bearing devices before disposal. This page provides a free, print-ready UK template covering every field an auditor expects: serial numbers, asset tags, destruction methods, operator details and signatures. Download it below, or read the field-by-field guide first.
Key facts at a glance
- Free single-page template — open in any browser, print or save as PDF
- One row per device: serial number, asset tag, media type, method, operator, date
- Methods covered: NIST 800-88 Clear/Purge and physical destruction to HMG IS5
- Retain completed certificates for at least five years
What must a certificate of data destruction contain?
A valid certificate of data destruction must identify every data-bearing device, the method used, the person responsible and the dates — all on one signed, referenced document. Each field in the template is there for a reason. Auditors want proof that ties each device to a destruction event. Vague or missing fields weaken the whole record.
| Field | Why auditors need it |
|---|---|
| Certificate reference and issue date | Makes each record unique and easy to retrieve in an audit. |
| Issuer details and waste carrier number | Confirms who did the work and that they could legally move waste. |
| Client details and job reference | Ties the certificate to your company and purchase records. |
| Collection date and address | Starts the chain of custody from your site. |
| Serial number and asset tag per device | Proves each single device was processed, not just a batch total. |
| Media type | Shows the right method was used — SSDs and hard drives differ. |
| Destruction method | Names a recognised standard: NIST 800-88 Clear/Purge or HMG IS5 destruction. |
| Operator and processing date | Records who destroyed the data and when. |
| Signatures from both parties | Turns the record into a formal declaration, not an informal note. |
For the legal background, see our full guide to certificates of destruction.
Why does serial-matching matter?
Serial-matching is what turns a certificate from a receipt into evidence. A certificate stating "40 laptops destroyed" cannot prove that any one laptop was among them. If a device later surfaces on the second-hand market with company data intact, a batch total offers no defence. A serial-matched certificate does: it shows that exact machine going through a documented process.
Serial numbers also let you check the certificate against your asset register. Record serials before collection, then match them to the completed certificate. Any device on your register with no matching certificate is a gap in your chain of custody. Gaps are what ICO investigations and ISO 27001 audits find first. The check takes minutes and is the strongest control in the disposal process.
How do you use the template?
Use the template for in-house wiping, or as a checklist for judging a supplier's paperwork. To complete it:
- Download the file, open it in any browser, and print it or save it as a PDF.
- Complete the issuer and client blocks, including the waste carrier registration number if equipment leaves your site.
- Record one row per device. Capture serial numbers before collection, never afterwards.
- Enter the method per device using the key: NIST 800-88 Clear or Purge for wiped drives, physical destruction to HMG IS5 for failed or high-sensitivity media.
- Have both parties sign, assign a unique reference, and file the certificate with your asset register for at least five years.
When should you use an ITAD provider instead of self-certifying?
Self-certified destruction carries less weight with auditors than an independent certificate from an accredited provider. A template shows diligence for small in-house jobs, but it cannot be impartial: the person wiping the drive and the person certifying it work for the same firm. For bulk disposals, leased assets or regulated data, independent certification is the safer route.
Innovent Recycling provides secure data destruction to NIST 800-88 and HMG IS5 (Enhanced) standards, with serial-matched certificates and asset reports for every data-bearing device. As an ISO 27001-certified IT asset disposal company, we collect free nationwide — from computer recycling in Manchester to any UK site — and working equipment can offset costs through IT equipment buyback. Book a collection online or call 0151 355 5482.
Frequently asked questions
Is a certificate of data destruction a legal requirement in the UK?
No law names the document itself, but UK GDPR's accountability principle requires you to evidence that personal data was securely destroyed. A certificate of data destruction is the accepted form of that evidence, and the ICO expects to see disposal records during an investigation.
Can I write my own certificate of data destruction?
Yes. If your team wipes drives in-house, a self-issued certificate is far better than no record. Include per-device serial numbers, the method, the operator and signatures. For high-risk or bulk disposals, an independent certificate from an accredited provider carries more weight.
Which destruction method should the certificate record?
Record the method actually applied to each device. NIST 800-88 Clear or Purge suits drives being reused or resold; physical destruction in line with HMG IS5 suits failed drives and highly sensitive media. Never record a generic "data destroyed" statement without naming the standard.
Does the template work for SSDs, phones and tapes?
Yes. The media type column covers hard drives, SSDs, tapes, mobiles and loose media. Note that basic overwriting is not reliable on SSDs and flash storage: record NIST 800-88 Purge or physical destruction for those devices, and degaussing only for magnetic media.