DataTerminology.comNEW
Also known as: Data Destruction, Data Erasure
Securely and irreversibly deleting data at end of life to minimize risk and meet obligations.
DESCRIPTION
Data disposal ensures data is irretrievably destroyed when it is no longer needed or when retention expires. Techniques include cryptographic erasure, secure overwrite, and physical destruction. Proper disposal reduces breach exposure, meets privacy requirements, and frees resources. It must be auditable, policy-driven, and validated for each storage medium and cloud service. Disposal should coordinate with legal holds, backups, and archives to prevent orphaned copies.
ALTERNATIVE DEFINITIONS
NIST Special Publication 800-88 Rev. 1
Media sanitization refers to a process of rendering access to target data on the media infeasible for a given level of effort.
Defines sanitization outcomes independent of specific techniques or tools.
UK Information Commissioner’s Office (ICO)
You must dispose of personal data securely, in a way that protects it from unauthorised access.
Stresses protection against unauthorized access during disposal.
[Source](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/records-management-and-security/secure- disposal/)
RELATED TERMS
Media Sanitization Right to be Forgotten Secure Deletion Data Lifecycle Management Data Minimization Records Management Data Encryption Key Management Asset Decommissioning
COMPETING TERMS
Data Retention
KNOWLEDGE AREAS
Data Privacy & Compliance Data Security Data Management Data Storage & Operations
TARGET AUDIENCE
Data Governance Manager Data Steward Data Engineer Chief Information Officer Cloud Architect Data Management Consultant
EXTERNAL SOURCES
- Wikipedia - Data erasure
- NIST - Authoritative guidance on media sanitization
- ISO/IEC 27040 - Storage security guidance including sanitization
TOP QUESTIONS
What methods are used for Data Disposal?
Common methods include cryptographic erasure, secure overwriting, and physical destruction. The choice depends on medium, sensitivity, and reuse requirements.
Category: Practice
How do backups affect Data Disposal?
Backups may retain deleted data. Coordinate disposal with backup retention and ensure eventual destruction or encryption key revocation.
Category: Risks
What evidence proves Data Disposal?
Certificates of destruction, sanitization logs, key revocation records, and audit trails substantiate compliant disposal.
Category: Compliance
When should Data Disposal occur?
Dispose when retention expires, consent is withdrawn, or processing purposes no longer apply, subject to legal holds.
Category: Requirements
Is cryptographic erasure sufficient for cloud Data Disposal?
Often yes, if keys are unique and inaccessible post-revocation. Validate provider guarantees and residual risk.
Category: Opinion
What is a common mistake in Data Disposal?
Overlooking secondary copies like caches, logs, and third-party systems, leaving residual data.
Category: Mistakes
Who is accountable for Data Disposal?
Controllers set policy; processors execute actions. Data stewards and platform teams implement tooling and verification.
Category: Governance
How does Data Disposal support privacy?
It limits exposure by removing unnecessary personal data and helps meet erasure rights and storage limitation principles.
Category: Relevancy
What standards guide Data Disposal?
NIST SP 800-88 and ISO/IEC 27040 provide guidance on sanitization and storage security.
Category: Standard