Compliance · Plane 2

Data protection

Regulation (EU) 2016/679 (GDPR)

Retired equipment contains media holding personal data, and the organisation remains responsible for it until it is verifiably deleted. EoL360 documents the sanitisation of every drive, linked to the asset it comes from.

What the regulation requires

Three requirements that must be read together:

Security appropriate to the risk. The organisation, as data controller, must protect personal data against unauthorised access, loss or destruction, applying technical and organisational measures appropriate to the risk.
The ability to demonstrate it. Applying those measures is not enough: the controller must be able to demonstrate that it applied them. This is the accountability principle.
Supplier guarantees. Where a third party processes the data on the organisation’s behalf — here, by handling the media during collection — only a processor offering sufficient guarantees may be chosen.

In practice:

a drive that leaves the organisation without an individualised sanitisation certificate leaves the company unable to demonstrate that it applied a security measure appropriate to the risk.

Why end of life is a critical moment

Formatting a drive or resetting a device does not verifiably delete the data. Until every drive is sanitised with a recognised method and this is put on record, the data continues to exist and liability remains with the organisation. The risk is concentrated in the stretches where the equipment is no longer under its direct control: prior storage, transport and processing by third parties.

Prior storage
Transport
Third-party processing
Certified sanitisation

Key articles

GDPR · art. 5.1.f

Principle of integrity and confidentiality: data must be processed ensuring «appropriate security», including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

GDPR · art. 5.2

The controller shall be responsible for compliance with those principles «and be able to demonstrate compliance (‘accountability’)».

GDPR · art. 24.1

The controller shall implement appropriate technical and organisational measures «to ensure, and to be able to demonstrate, that processing is performed in accordance with» the Regulation.

GDPR · art. 28.1

Only a processor «providing sufficient guarantees» to implement appropriate technical and organisational measures may be chosen.

GDPR · art. 32.1 and 32.2

Security of processing: appropriate measures to ensure «a level of security appropriate to the risk» (32.1), taking into account in particular the risk of «unauthorised disclosure of, or access to», the data (32.2).

What EoL360 documents

Obligation	Document or function
Appropriate security and the ability to demonstrate it	Wiping certificates: one individual certificate per drive, linked to the asset and retrievable by device, batch or fiscal year.
Control of the risk stretches	Chain of custody: every handover of the equipment, signed and dated, from the site to sanitisation.
Processor guarantees	Data-processing agreement: the operation is formalised through the corresponding agreement, with documented instructions and measures.

Sanction regime

See fines

Breaching the security-of-processing obligations (arts. 25 to 39, including art. 32) can be sanctioned with fines of up to €10,000,000 or, for a company, up to 2% of its total worldwide annual turnover, whichever is higher (art. 83.4). Where the art. 5 principles are breached, the limit rises to €20,000,000 or 4% (art. 83.5).

Sanitisation, turned into evidence.

We show you how EoL360 would document the sanitisation of every drive in the organisation’s next refresh process.

Talk to an expert