This document supplements the requirements of BU Data Protection Guideline 1.2.D – Data Protection Requirements. It provides information related to the proper disposal of sensitive information in such a way as to prevent its continued use.
Overview
When data is no longer required it must be disposed of in a way that prevents its continued use. Electronic data can be difficult to dispose of effectively. Reusable storage devices are intended to have a long service life and may be erased and rewritten continuously during their life. Hard disk drives, USB storage devices, solid-state memory cards, portable disk drives, floppy diskettes, and data storage tapes are all examples of media intended for reuse.
There are legal, regulatory, contractual, and policy requirements that may extend the duration for which information must be retained beyond its useful life. Before disposing of data please review the University Record Retention Policy (FA-002). DO NOT destroy paper or electronic records that the University Record Retention Policy (FA-002) requires be maintained. In addition, DO NOT destroy records if you have received a “litigation hold” notice from the Office of the General Counsel concerning actual or threatened litigation or if you have reason to believe that documents relate to a dispute that may result in litigation. If you have any questions, please contact BU Information Security or the Office of the General Counsel before you destroy either paper or electronic records.
Securely Erasing Entire Reusable Storage Devices (Disk Drives, USB devices, Tapes)
The delete function in most operating systems makes the data unavailable via the standard user interface but does not actually remove it from the storage device. To ensure that the data cannot be recovered, special tools must be used. These tools overwrite the storage device with random data. This form of securely erasing a storage device prior to disposal is a recommended practice for any storage device, even if it contained only Public information.
A reusable storage device must be securely erased when it contains Internal, Confidential, or Restricted Use Information and any of the following statements are true:
- It is being permanently taken out of service.
- It is being temporarily taken out of service and will be out of the custody of the Data Custodian or Data Trustee for any length of time.
- The disk will be classified and protected at a lower level than its current classification as defined by the Data Classification Guideline and Data Protection Requirements.
- The disk is being returned to a vendor for replacement under a hardware warranty or contract-support agreement, provided that physical destruction is not required by the following section.
For Intel and AMD hardware platforms we recommend a program called DBAN which will boot on any x86 based hardware and securely erase the disk: