Friday 20 March 2026
Internal Reference Number: FOI_9267
Date Request Received: 05/03/2026 00:00:00
Date Request Replied To: 18/03/2026 00:00:00
This response was sent via: By Email
Request Summary: Recorded Assurance for Software Based Data Erasure of End of Life IT Equipment
Request Category: Private Individuals
| Question Number 1: Under the Freedom of Information Act 2000, please provide the following recorded information held by your organisation regarding assurance processes for software based data erasure of end of life IT equipment. For clarity, this request relates specifically to the erasure of storage media associated with end of life hardware such as laptops, desktops, servers, storage arrays, or other data bearing IT equipment. It does not relate to operational deletion of data within live systems, routine account management, or DSP Toolkit self assessment processes. Physical destruction methods such as shredding, crushing, degaussing, or disintegration are outside the scope of this request. This request concerns software based erasure only. This request seeks to distinguish between confirmation that an erasure process was carried out and recorded evidence demonstrating that the final data state of a specific storage device is irrecoverable. I am not seeking technical configuration detail or security sensitive information, only the recorded assurance basis relied upon when concluding that personal data has been rendered irrecoverable. Please confirm: Whether your organisation’s policies, contractual terms, or internal procedures require an explicit outcome based warranty or guarantee that personal data on a specific storage device has been rendered irrecoverable as a final data state following software based erasure. | |
| Answer To Question 1: All devices sent to third party suppliers are required to have a corresponding disposal certificate as proof that data has been erased to the latest cyber standards. | |
| Question Number 2: Where software based erasure of storage media is undertaken internally, what recorded evidential assurance is relied upon to conclude that the final data state of the specific storage device is irrecoverable, as distinct from confirmation that an erasure process was executed. | |
| Answer To Question 2: Storage media is not erased internally; however we do reimage laptops and PC’s internally to be reused within the Trust , there is no data held on these devices as they rely on network storage. | |
| Question Number 3: Where software based erasure is undertaken by a third party provider: a. Do the certificates or contractual documents held constitute an explicit outcome based warranty or guarantee of irrecoverability for each specific storage device processed? b. Beyond reliance on supplier accreditation or recognised standards including but not limited to ADISA certification, ISO accreditation, NIST alignment, HMG IA standards, NHS Digital guidance, or Data Security and Protection Toolkit assertions, and beyond confirmation that a wiping process was completed, does the organisation hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the storage media has been rendered irrecoverable in practice? | |
| Answer To Question 3: a) Yes b)Third party companies are audited for compliance assurance. | |
| Question Number 4: If no explicit outcome based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm what recorded form of evidential assurance is relied upon when concluding that personal data has been rendered irrecoverable. | |
| Answer To Question 4: N/A | |
| To return to the list of all the FOI requests please click here |
Our staff at Salisbury District Hospital have long been well regarded for the quality of care and treatment they provide for our patients and for their innovation, commitment and professionalism. This has been recognised in a wide range of achievements and it is reflected in our award of NHS Foundation Trust status. This is afforded to hospitals that provide the highest standards of care.
