Despite growing awareness of data protection obligations, a surprising number of businesses still operate on outdated assumptions about what it takes to make data unrecoverable. Some of these myths are harmless; others create genuine regulatory and reputational risk.
The first and most common myth is that deleting files or reformatting a drive removes the data. It does not. Both actions simply remove the pointers the operating system uses to locate files, leaving the underlying data intact on the disk until it happens to be overwritten by something else — which may never happen on a drive being retired. Recovery software widely available online can reconstruct “deleted” files from a reformatted drive in minutes. This is the single most important misconception to correct in any organisation’s IT offboarding process.
A second myth is that factory resets on smartphones and tablets guarantee data removal. Modern mobile operating systems have improved significantly here, particularly where encryption is enabled by default, but older devices, devices with removable storage, or resets that fail partway through can leave recoverable data behind. Mobile devices should be treated with the same sanitisation discipline as laptops and servers, not as an afterthought because they feel less significant.
A third myth is that physical destruction is always safer than erasure. As covered in more detail elsewhere on this site, a properly verified erasure process to a recognised standard such as NIST 800-88 provides equivalent assurance to destruction for the vast majority of commercial data, while preserving the resale or reuse value of functioning hardware. Destruction is not automatically “more secure” — it is a different tool for different circumstances, and an unverified destruction process is no more trustworthy than an unverified wipe.
A fourth myth, particularly persistent among smaller organisations, is that data sanitisation is only a concern for larger enterprises or regulated industries. UK GDPR applies to any organisation processing personal data regardless of size, and the Information Commissioner’s Office has taken enforcement action against small businesses for data breaches arising from improperly disposed IT equipment, including cases involving second-hand drives sold on public marketplaces still containing recoverable personal data.
Finally, there is a belief that a verbal or informal assurance from whoever handles disposal — an IT manager, a facilities team, a general recycling contractor — is sufficient evidence of compliance. It is not. Auditors and regulators expect documented evidence: a certificate tied to specific serial numbers, referencing a recognised sanitisation standard, from a provider who can demonstrate their process on request.
Correcting these misconceptions costs nothing beyond updating an internal policy document, but the cost of continuing to operate on them, in the event of a breach, can be substantial.