- Date released: 1 April 2026
- Request number: 202603081
- Release of information under: Freedom of Information Act 2000 (FOIA)
Information requested
What I am seeking to understand is whether your organisation holds any recorded evidence of the outcome, namely evidence that the data on a specific storage device is irrecoverable following erasure, rather than confirmation that the erasure process was executed.
With that distinction in mind, please confirm:
- Do the destruction certificates referenced in your response (FOI202602073) constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure or destruction process compliant with recognised standards or NCSC guidance was followed?
- Beyond reliance on supplier accreditation, recognised standards including but not limited to ADISA certification, ISO accreditation, HMG IA standards, NCSC guidance, or confirmation that an erasure process was completed, does your organisation hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice? For clarity, this request relates specifically to recorded outcome evidence demonstrating irrecoverability of data on the individual storage device, not documentation confirming that an accredited or certified method was applied.
- If no explicit outcome based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.
Information released
We confirm that under s.1 of the FOIA, we hold some of the information you have requested. Please see below for a response to each of your questions in turn.
Do the destruction certificates referenced in your response (FOI202602073) constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure or destruction process compliant with recognised standards or NCSC guidance was followed?
I can confirm that the destruction certificates do not constitute an explicit outcome-based warranty or guarantee that the personal data on each storage device has been rendered irrecoverable as a final state. The destruction certificate states all data bearing assets have been destroyed in accordance with Government standards and list the following underpinning standards:
- Quality Management System – ISO 9001
- Occupational Health and Safety Management System – ISO 45001
- Information Security Management System – ISO 27001
- Environmental Management System – ISO 14001
- IT Service Management System – ISO 20000-1
- Environment Agency Waste Management Licence
Beyond reliance on supplier accreditation, recognised standards including but not limited to ADISA certification, ISO accreditation, HMG IA standards, NCSC guidance, or confirmation that an erasure process was completed, does your organisation hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice?
I can confirm that we do not hold nor record evidence of independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable.
If no explicit outcome-based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.
I can confirm that we do not hold any evidence beyond certification of the supplier and the destruction certificates.
Exemption(s) applied:
None
Public Interest Test (PIT):
N/A