Data Wiping, Sanitisation, Degaussing and Physical Destruction: What Do They Mean?

Every retired laptop, server or hard drive holds data long after it stops being used — customer details, financial records, employee information, system credentials, intellectual property and confidential communications can all still be sitting on a drive that looks empty. When a device reaches end of life, “deleted” doesn’t mean “gone.” This guide explains what data wiping, sanitisation, degaussing and physical destruction actually mean, how they differ, and which one fits your data destruction policy.

At a Glance

• Data sanitisation makes data unreadable without destroying the device; data destruction physically destroys the device so it can no longer be used at all.
• Overwriting and cryptographic erasure are sanitisation methods that keep hardware reusable, resellable or donatable.
• Degaussing and physical shredding are destruction methods that render the device permanently unusable.
• We erase drives to NIST 800-88 using Blancco, ADISA-certified software, or physically shred them to 6–8mm (hard drives), 2mm (SSDs) or 10mm (LTO tapes), depending on policy.
• UK GDPR and the Data Protection Act 2018 require secure, evidenced destruction of personal data — a certificate should always accompany whichever method is used.

Why This Terminology Actually Matters

These terms get used interchangeably in everyday conversation, but they describe genuinely different processes — with different costs, different effects on the hardware, and different levels of assurance. Picking the wrong one isn’t just a technicality: under UK GDPR and the Data Protection Act 2018, businesses are required to handle and destroy personal data securely, and being able to say which method was used, and why, is part of demonstrating that.

Data Sanitisation vs Data Destruction

Almost every other term in this space falls under one of these two categories.

Data Sanitisation

Sanitisation is an irreversible process that makes data unreadable without destroying the device itself. Done properly, no forensic method should be able to reconstruct it — but the hardware survives, and can be reused, resold or donated.

Data Destruction

Destruction doesn’t preserve the device. The storage media itself is physically destroyed, so the data is lost along with it and the hardware is no longer functional.

Methods of Data Sanitisation

Overwriting

Overwriting replaces existing data with meaningless patterns of 0s and 1s. It typically needs multiple passes to make recovery reliably impossible, and works on hard drives, SSDs and most other storage media. Because it leaves the device intact and usable, it’s the method behind resale and redeployment — a laptop that’s been securely wiped can go back into use rather than being scrapped.

Best when: you want to resell or reuse the equipment, and you’re working with a smaller volume of devices.

Cryptographic Erasure

Cryptographic erasure works differently: the data itself is encrypted, and erasure means destroying the encryption key rather than overwriting the data directly. Without the key, the data is permanently inaccessible. It’s much faster than repeated overwriting passes, which makes it well suited to large volumes of devices, and it’s commonly used for SSDs and cloud environments.

Best when: you’re processing bulk equipment, particularly SSDs.

Methods of Data Destruction

These methods destroy the device along with the data, so they should always be carried out by a certified provider working to a recognised standard such as NIST 800-88, not simply taken to any scrapyard.

Degaussing

Degaussing applies a high-powered magnetic field to disrupt the magnetic structure of the storage media, erasing the data. It’s fast and effective for magnetic media specifically — backup tapes, floppy disks and traditional HDDs — but it has two real limitations: it renders the device permanently unusable, and it has no effect at all on SSDs, which don’t store data magnetically.

Best when: you have older HDDs or magnetic tape, need fast bulk destruction, and reuse isn’t a priority.

Physical Destruction

Physical destruction means mechanically breaking a device down until data recovery is impossible. We shred hard drives to 6–8mm and SSDs to 2mm — small enough that no platter or chip fragment retains a recoverable amount of data.

Best when: the data is highly sensitive, or the device has no realistic reuse value.

Incineration

Incineration burns devices at high temperatures until they’re damaged beyond any possibility of data recovery. It’s used in the industry for particularly sensitive material, though it sits at odds with the reuse and materials-recovery goals of most IT asset disposal programmes, since nothing about the device is recoverable afterwards.

Which Method Should You Use?

The right method depends on what happens to the device next, and how sensitive the data is:

• If the equipment still has resale or reuse value and the data isn’t highly sensitive: overwriting or cryptographic erasure.
• If you’re processing a large volume of SSDs or cloud-based storage: cryptographic erasure.
• If you have older magnetic media you need to destroy quickly and reuse isn’t a factor: degaussing.
• If the data is highly sensitive, or the device has no further use: physical shredding.

What This Means for Your Data Destruction Policy

Whichever method fits, the process should be documented, not just performed. A proper record shows what was destroyed, how, when, and by whom — tied to specific serial numbers, not a general statement that equipment was “processed.” That’s the evidence UK GDPR accountability actually requires, and it’s what a Data Destruction Certificate is for.

We handle data sanitisation and destruction to NIST 800-88 using Blancco, ADISA-certified erasure software, or physical shredding where destruction is required, with a certificate issued for every collection within 5 working days. Full certifications are available on our licenses page.