Choosing GDPR Compliant Device Erasure Software

Searches for "GDPR compliant erasure software" are common, but the phrase can mislead. The GDPR, and the UK GDPR that applies in the United Kingdom alongside the Data Protection Act 2018, does not approve or certify data erasure products. Compliance belongs to the organisation that controls the data. What software can do is make it easier to carry out, and evidence, the security and accountability duties the regulation places on you when devices are retired.

This guide explains which GDPR obligations are relevant to device erasure, and how to assess erasure software against them.

Is there GDPR compliant erasure software?

No software is GDPR compliant on its own, and the GDPR does not certify products. Erasure software supports compliance by applying a suitable method and producing records that help you meet the security and accountability principles.

Which GDPR duties apply when devices are retired

Several principles and articles come into play when a laptop, desktop, server drive or phone reaches the end of its working life:

• Integrity and confidentiality (Article 5(1)(f)): personal data must be processed with appropriate security, including protection against unauthorised processing and accidental loss. Data left on a resold laptop is a classic failure of this principle.
• Storage limitation (Article 5(1)(e)): personal data should not be kept longer than necessary. A retired device holding old customer records is data you no longer need.
• Accountability (Article 5(2)): you must be able to demonstrate compliance, not just achieve it. That is where erasure records matter.
• Security of processing (Article 32): controllers and processors must use technical and organisational measures appropriate to the risk.
• Processors (Article 28): if a third party erases or collects devices on your behalf, you need a written contract that covers what they do.

The Information Commissioner's Office (ICO) expects organisations to secure personal data throughout its lifecycle, including when equipment is disposed of, reused or given away. If a retired device later exposes personal data, a personal data breach may need to be reported to the ICO within 72 hours of becoming aware of it.

What to look for in erasure software

Methods that suit your storage

The software must actually remove data from the media you retire. For hard drives, overwriting all addressable locations is effective. For SSDs, wear levelling means simple overwriting cannot be relied on, so the tool should use the drive's own sanitise commands, such as block erase or cryptographic erase, where they are supported. NIST SP 800-88 Rev. 2 and IEEE Std 2883-2022 describe these methods in terms of Clear, Purge and Destroy, and NIST recommends Purge over Clear where possible. Our guide to data destruction standards that matter explains how these frameworks fit together.

Coverage of every drive

Desktops and workstations often contain more than one drive. Software that runs inside the installed operating system may struggle to erase the drive it is running from. A bootable tool that erases every detected drive closes that gap.

Clear results and usable records

Accountability depends on evidence. Look for a tool that clearly shows whether each erasure succeeded or failed, and, where you need documentation, produces a report you can store against the asset. Useful records include the device and drive serial numbers, the method used, the date, the outcome and who carried out the work.

Clear failure handling

A drive that fails to erase must not be treated as complete. The software should make failures obvious so they can be retried or sent for physical destruction.

Honest claims

Be wary of products marketed as "GDPR certified" or "NIST certified". Neither the GDPR nor NIST certifies erasure products. Independent product testing schemes do exist; if a contract or policy requires one, check the current certificate and its scope before relying on it.

A cost model that encourages consistent use

If every wipe consumes a paid credit, there is a temptation to delay erasure or skip lower-priority devices. Unlimited-use licensing removes that pressure and makes it easier to erase every device, every time.

The organisational side

Software is only one of the "technical and organisational measures" Article 32 refers to. A sound process also includes:

• a written policy that says which devices must be erased, by whom and to what standard;
• an asset register that tracks devices from retirement to final destination;
• secure storage for devices awaiting erasure;
• training so staff recognise failed erasures and know the exception route;
• contracts with any third-party processors that handle devices or data;
• retention of erasure records for as long as your policy requires.

Our device retirement compliance guide walks through building these controls.

Where RedKey USB fits

We built RedKey USB as a bootable erasure tool for supported PCs and Intel Macs. It runs before the installed operating system loads, erases the drives it detects, and is sold as a one-time purchase with unlimited use. The Professional and Ultimate editions produce a PDF report for each erasure, which helps with GDPR accountability; the Home edition shows the result on screen only, so you would need to record the outcome yourself. Erasure of supported iPhone, iPad and Android devices is available in the Ultimate edition.

Whatever tool you choose, it supports your compliance rather than delivering it. The responsibility for choosing a suitable method, applying it consistently and keeping the evidence stays with your organisation.

Quick assessment checklist

1. Does the tool use methods suited to each storage type you retire?
2. Does it erase every detected drive, not just the system drive?
3. Does it show a clear pass or fail for each device?
4. Can it produce a report you can file against the asset, if you need one?
5. Are its claims about standards and certification accurate and current?
6. Does the cost model encourage erasing every device?
7. Have you documented the organisational controls around it?

This article is general guidance, not legal advice. For specific obligations, consult the ICO's guidance or a qualified adviser.

Frequently asked questions

Does right to erasure mean wiping the whole device?

Not necessarily. The right to erasure covers a person's data wherever you hold it; wiping retired devices is one part of meeting it, alongside deleting records in live systems and backups as your policy allows.

What is the safest way to keep work files confidential when giving away an old laptop?

Sanitise the whole drive with a suitable method before it leaves your control and record the result. Deleting files or reinstalling the operating system is not enough.

For GDPR accountability records, RedKey USB Professional produces a PDF report for every erasure. Related reading: Device Retirement Compliance Guide for IT Teams and Data Destruction Standards That Matter.