There are a number of suitable destruction methods for physical and digital information.
Physical information
Methods for destroying physical information such as papers, photographs and films include:
- shredding – cross shredding may be needed for some sensitive documents
- pulping – pulped paper is reduced to fibres
- burning – only use it as a last resort in an appropriate industrial facility if no other destruction method is available.
Digital information
Digital information deletion does not mean destruction.
When digital information is deleted, it is only the pointer (the link) to that information (such as the file name and directory path) that is deleted.
The actual data objects are gradually overwritten in time by new data. Until the data is completely overwritten, there remains a possibility that the information can be retrieved.
Sanitisation
The process of erasing or overwriting information stored on digital media is called sanitisation. The extent of sanitisation used depends on the information's classification.
Choose a destruction method based on a risk assessment of the information's sensitivity and align the classification with a sanitisation method.
Sanitisation methods for destroying digital information include:
- Clearing – the information is cleared from the media or overwritten and is hidden under layers of nonsensical data so it cannot be retrieved through disk or file recovery utilities.
- Purging – the information is randomised so that it is no longer readable and cannot be reconstructed from digital media using nonstandard systems operating outside the media's usual working environment (known as a laboratory attack).
- Degaussing – recorded data is erased through demagnetising magnetic media.
- Destruction – the most extreme form of sanitisation ensures the media is drastically altered and can never be reused by physically destroying carriers of digital information such as hard drives and discs.
The various destruction methods include:
- shredding
- disintegration
- incineration
- pulverisation
- melting.
To ensure the digital information's complete destruction, find and destroy all copies. Remove and destroy copies contained in:
- system backups
- the cloud
- offsite storage.
Where information is stored in the cloud, your agency should ensure that the contract stipulates, under retention and disposal requirements, that all copies should be destroyed.
