# Standards and Regulatory References — Secure Data Destruction

## Primary Standards

### NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization (December 2014)
- Defines three sanitization levels: Clear, Purge, Destroy
- Provides media-specific sanitization techniques for HDD, SSD, tape, optical, mobile
- Appendix A: Minimum Sanitization Recommendations by media type
- Establishes verification requirements for each sanitization level

### DIN 66399 — Office Machines — Destruction of Data Carriers
- Part 1: Principles and definitions
- Part 2: Requirements for machines
- Part 3: Process of data destruction
- Security levels P-1 through P-7 for paper; E-1 through E-7 for electronic media; H-1 through H-7 for hard drives; T-1 through T-7 for magnetic tapes; O-1 through O-7 for optical media; F-1 through F-7 for film

### EN 15713:2009 — Secure Destruction of Confidential Material
- European standard for organizations providing secure destruction services
- Requirements for personnel vetting, premises security, equipment standards, process controls, and chain of custody

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 5(1)(f)** — Integrity and confidentiality: secure processing includes secure destruction
- **Article 17** — Right to erasure: secure destruction is the final execution of erasure
- **Article 32** — Security of processing: destruction procedures as a security measure

### UK Data Protection Act 2018
- **Section 40** — Data protection principles including security of processing

### WEEE Regulations 2013
- Requirements for disposal of waste electrical and electronic equipment
- Applies to destruction of electronic storage media

## Regulatory Guidance

### ICO (UK Information Commissioner's Office)
- **ICO guidance on data destruction** — Recommends secure destruction with documented verification
- **ICO guidance on disposing of IT equipment** — Requirements for sanitization before disposal or re-use

### NSA/CSS
- **NSA/CSS EPL (Evaluated Products List) for degaussers** — Approved degausser models for classified media sanitization
- **NSA/CSS PM 9-12 Storage Device Declassification Manual** — Procedures for sanitizing classified storage devices

## Industry Certifications
- **ADISA (Asset Disposal & Information Security Alliance)** — Certification for IT asset disposal companies
- **R2 (Responsible Recycling)** — Standard for electronics recyclers
- **e-Stewards** — Certification for responsible electronics recycling

## Technical Standards
- **ISO/IEC 27001:2022 Annex A Control A.7.14** — Secure disposal or re-use of equipment
- **ISO/IEC 27001:2022 Annex A Control A.8.10** — Information deletion
- **ISO/IEC 27040:2015** — Storage security (includes sanitization guidance)