Data Destruction Importance for Businesses: Why You Need It

Data destruction isn't optional for businesses -- it's a legal requirement. Here's what's at stake and how to build a secure destruction program.

Every year, thousands of businesses expose sensitive data through improper device disposal. Hard drives sold on eBay, donated computers, and discarded servers regularly turn up containing customer records, financial data, and employee information -- all perfectly recoverable with free tools.

For businesses, this isn't just embarrassing -- it's illegal. HIPAA requires covered entities to implement written policies for destroying ePHI. The FTC's Disposal Rule (under FACTA) requires businesses to take reasonable measures to protect against unauthorized access to consumer report information when disposing of consumer report data. State breach notification laws apply the moment disposal of sensitive data is found to be inadequate.

The solution is a documented data destruction program with three components: a policy (when and how data is destroyed), a procedure (the specific steps followed for each device type), and documentation (certificates proving destruction occurred for each device).

MicroAnt provides customer certificates listing individual serial numbers and maintains records for processed media. Ask your privacy officer or legal adviser which disposal and recordkeeping requirements apply to your organization.

Don't wait for a breach notification event to discover your disposal process has gaps. A single certificate of destruction costs a fraction of a data breach response -- and the peace of mind is priceless.