Disclosure Scotland - Assurance processes for software based data erasure of end of life IT equipment: FOI release

Information requested

1. Do the IT asset disposal certificates or related contractual terms held by your organisation constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure process was followed? Primarily confirm that the list of devices has been erased to the required standard

2. Beyond reliance on supplier accreditation, recognised standards including but not limited to ADISA certification, ISO accreditation, HMG IA standards, or confirmation that an erasure process was completed, does your organisation hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice?

Response

In answer to both of your questions, Disclosure Scotland does not specifically record outcome evidence demonstrating irrecoverability of data on individual storage devices. The destruction is physically witnessed as it's done on site.

Disclosure Scotland receives the Certificate of WEEE disposal and the documentation confirming material has been destroyed to the required standard.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.