How to Destroy a Hard Drive Securely: A Business Guide

The reliable way to destroy a hard drive is to erase it with verified software first, then physically shred it to small particles at a controlled facility and get a certificate of destruction listing its serial number. Drilling holes or hitting a drive with a hammer damages it but can leave most of the data surface intact. SSDs need different handling from traditional spinning hard drives, because degaussing does not work on them and their data is spread across many small chips.

For a home user with one old drive, careful physical damage may be an acceptable risk. For a business holding personal data, it is not, because UK GDPR requires you to be able to show the data was made unrecoverable.

HDD vs SSD: why the drive type changes the method

Before choosing a method, identify what kind of storage you have. Most laptops sold in recent years contain an SSD, while older desktops, servers and network storage often still hold spinning hard disk drives.

• Hard disk drives (HDDs) store data magnetically on rigid platters. The data sits on the platter surface, so the platters are what must be destroyed or erased.
• Solid state drives (SSDs), including M.2 and NVMe drives, store data on flash memory chips. There are no platters and nothing magnetic to wipe with a degausser. The drive's controller also moves data around and keeps spare blocks, so simple overwriting may not reach every cell.
• Embedded storage in phones, tablets and many thin laptops is soldered to the main board. It cannot be removed as a separate drive, so the whole board or device must be erased or destroyed.
• Hidden storage exists in printers, copiers, CCTV recorders, network switches, routers and medical devices. These are often missed in disposal projects.

The National Cyber Security Centre's guidance on secure sanitisation treats all storage media the same way at the planning stage: if a device might hold data, sanitise it.

Erasure vs degaussing vs shredding

There are three main ways to make data unrecoverable. They are often used together.

Software erasure (data wiping)

Erasure software overwrites all user-accessible storage with fixed data, or triggers the drive's built-in secure erase or sanitise command. The NCSC recommends verifying the result by reading back the storage and checking for remapped or bad sectors that may still hold data.

• Good for: working drives you want to reuse, resell or return to a leasing company.
• Limits: it needs a working drive. Failed drives, drives with many bad sectors and some SSDs cannot be fully verified.
• Encrypted devices: if full disk encryption was on from the start, a factory reset that deletes the encryption keys makes the data unreadable in most cases, although NCSC notes this cannot guarantee every trace is gone.

Degaussing

A degausser applies a strong magnetic field that scrambles the magnetic pattern on an HDD's platters. It destroys the drive as well as the data.

• Good for: magnetic media such as HDDs and backup tapes, including drives that no longer power on.
• Limits: it only works on magnetic media, so it does nothing to SSDs, USB sticks or memory cards. NCSC also warns that not all degaussers work on all hard disk technologies, so capability must be checked. There is no easy way to see that it worked by looking at the drive.

Physical shredding

An industrial shredder cuts drives into small fragments. NCSC guidance gives a particle size of 6mm or less for destroyed media, and still recommends erasing first where possible.

• Good for: failed drives, SSDs, highly sensitive data and any drive you have no intention of reusing.
• Limits: the drive cannot be reused, and the shredder must be suitable for the media. SSD chips are small, so a shredder sized for HDDs can leave memory chips intact.

Why drilling and hammering are not enough for a business

Search results for how to destroy a hard drive are full of DIY methods: drilling holes through the platters, bending them, hitting them with a hammer or putting them in a fire. These methods share the same problems.

• Most of the surface survives. A few holes through a platter leave large undamaged areas. Data recovery specialists work on damaged platters routinely.
• SSDs defeat them. Each memory chip holds data independently. A hole through the circuit board can miss every chip.
• Nothing is recorded. You end up with a damaged drive and no evidence of which drive it was, who did it, or when.
• They create other hazards. Burning electronics releases toxic fumes, glass platters in some drives shatter, and the leftovers are still WEEE that needs proper disposal.
• They do not scale. Hammering one drive is possible. Hammering two hundred drives from an office refresh, consistently and with records, is not.

UK GDPR: what accountability means for drive disposal

Under Article 5 of the UK GDPR, personal data must be processed with appropriate security, including protection against unauthorised processing and accidental loss. Article 5(2) adds the accountability principle: the controller must be responsible for, and be able to demonstrate, compliance.

For drive disposal, that means you need more than a belief that the data has gone. You need evidence that ties each data-bearing asset to the method used and the date it happened. If you use an outside company, it acts as your data processor. The ICO expects a written contract that sets out the services, an approved disposal specification aligned with your security policy, details of any downstream partners, and the right to audit the provider. Our article on IT asset disposal under UK GDPR and WEEE covers the wider framework.

What a certificate of data destruction should contain

There is no single legal template, but a certificate that will stand up to an audit should let you match every drive you handed over to its fate. Check for:

• Your organisation's name and the collection address.
• The provider's name, address and waste carrier registration.
• A unique certificate or job reference.
• Collection date and destruction or erasure date.
• An itemised list of assets with serial numbers, and asset tags where you use them.
• Media type for each item (HDD, SSD, tape, mobile device).
• The method used for each item: erasure (with the standard and software), degaussing or shredding (with particle size).
• Notes of any exceptions, such as drives that failed erasure and were shredded instead.
• The name and signature of the person authorising the certificate.

A certificate that just says "50 hard drives destroyed" is weak evidence. If one drive later turns up, you cannot show whether it was ever on the list.

Chain of custody: from desk to destruction

Chain of custody is the record of who held each device at every stage. The ICO says devices should not leave your organisation until it is clear who is responsible for deleting the data, and that you should record who you are handing them to. A sound process looks like this:

1. Inventory. List every device marked for disposal, with serial numbers, before anything moves. Include printers, phones and network kit.
2. Secure storage. Keep retired devices in a locked room or cage with restricted access. Old drives on an open shelf are a common source of loss.
3. Handover. Count and sign devices out to the provider. Both parties keep a copy of the collection list.
4. Secure transport. Devices travel in sealed containers or locked vehicles directly to the processing site.
5. Processing and reconciliation. Each serial number is matched against the collection list, processed and logged. Any discrepancy is reported to you.
6. Certificate and waste paperwork. You receive the destruction certificate, plus a waste transfer note for the equipment, because shredded drives and the rest of the IT kit are still WEEE.

If you are clearing laptops rather than loose drives, our guide on how to dispose of old laptops walks through the full process, including batteries.

Frequently Asked Questions

What is the best way to destroy a hard drive?

For a business, the most reliable approach is verified software erasure followed by industrial shredding, with a certificate that lists each drive's serial number. NCSC guidance gives a destroyed particle size of 6mm or less.

Does drilling holes in a hard drive destroy the data?

Not reliably. Drilling leaves most of the platter surface intact, and on an SSD it can miss the memory chips entirely, so data may still be recoverable.

Does degaussing work on SSDs?

No. Degaussing only works on magnetic media such as HDDs and tapes. SSDs store data on flash memory and need erasure using the drive's sanitise commands or physical shredding.

What should a data destruction certificate include?

It should include a unique reference, the collection and destruction dates, an itemised list of serial numbers, the media type, the method used for each item and an authorised signature.

How do I dispose of hard drives after destruction?

Destroyed hard drives are still electrical waste, so they must go to a permitted treatment facility with a waste transfer note rather than into general waste.

How Waste Experts handles hard drive destruction

Waste Experts collects data-bearing equipment and processes it at our own Environment Agency regulated AATF in Huddersfield, rather than passing it to a third party. Each data-bearing device is logged by serial number and goes through either certified erasure to HMG IS5 or physical shredding, followed by a Certificate of Data Destruction with the serial number log. The remaining equipment is treated as WEEE and comes with the waste transfer documentation you need for your duty of care records.

See our ITAD and data destruction service for loose drives and servers, or our IT equipment recycling page for full office clearances.

Business customers only. Waste Experts collects from businesses and organisations, not households, and CEF branch drop-off is for business waste only. If you are getting rid of waste from your home, use your council's household waste recycling centre or a retailer take-back scheme instead.