Data sanitisation – A guide for businesses

Data sanitisation is the process of protecting data from accidental or unauthorised access, use, disclosure, alteration, or destruction. In other words, data sanitisation removes confidential data from a device or system in a manner that renders the data unrecoverable.

Every business should have a data sanitisation policy in place to protect against data breaches and theft. In this guide, we will explain what data sanitisation is and why it is important for businesses. We will also discuss different methods of data sanitisation and how to get started with it in your organisation. Finally, we will answer some frequently asked questions about it.

Why is data sanitisation important?

It is important because it helps to protect data from unauthorised access, use, disclosure, alteration, or destruction. Data breaches can occur when confidential data is left on a device or system that is not properly protected. By removing confidential data from devices and systems in a manner that renders the data unrecoverable, data sanitisation helps to prevent data breaches.

Different types of data

Different data assets may need sanitising depending on the business. For example, customer data, employee data, financial data, and intellectual property (IP) data are all valuable data assets that should be protected by data sanitisation.

Customer data	Employee data	Financial data	Intellectual property (IP) data
This is any data that relates to customers or clients of a business. This data may include contact information, purchase history, and demographic data.	This is any data that relates to employees of a business. This data may include contact information, job titles, salaries, and performance reviews.	This is any data that relates to the finances of a business. This data may include account numbers, transaction history, and credit card numbers.	This is any data that relates to the intellectual property of a business. This data may include trademarks, patents, and copyrighted material.

What can this data be stored on

Data can be stored on many different types of devices and systems, including computers, smartphones, tablets, servers, and network storage devices. It is important to sanitise data on all of these devices and systems.

• Computer hard drives
• Smartphones
• Tablets
• Servers

All data on these assets needs to be sanitised by either physically destroying the device or deleting the data, encrypting it, or performing a factory reset. Not all these methods are effective at destroying data and depending on the level of security required may not be appropriate.

Photocopiers and printers also store data and should be sanitised when they are no longer needed. It easy to overlook these devices as they are not typically thought of as data storage devices.

What are the different methods of data sanitisation?

• Physical destruction
• Erasure
• Encryption
• Data masking

Physical destruction

This involves destroying the physical media on which the data is stored (e.g., hard drives, SSDs, and CDs).

There are several methods of physical destruction, including shredding, pulverising, deguassing and burning. Shredding is the most common method of physical destruction, and it involves shredding the data storage devices into tiny pieces. Pulverising is another common method of physical destruction, and it involves crushing the data storage devices into a powder. Burning is a less common method of physical destruction, and it involves incinerating the data storage devices.

Erasure

This involves overwriting the data on the media with new data or with random data (also known as data scrubbing). There are several methods of erasure, including data wiping and data erasure. Data wiping is the most common method of erasure, and it involves overwriting the data on the data storage devices with new data. Data erasure is another common method of erasure, and it involves overwriting the data on the data storage devices with random data.

Encryption

This involves encoding the data so that it can only be decrypted with a key. There are several methods of encryption, including symmetric-key encryption and public-key encryption. Symmetric-key encryption is the most common method of encryption, and it involves encoding the data with a secret key. Public-key encryption is another common method of encryption, and it involves encoding the data with a public key.

Data masking

Data masking is a way to protect your data from people who should not have access to it. data masking is a way to make sure that your data is not seen by people who are not supposed to see it.

There are several methods of data masking, including data obfuscation and data anonymisation. Data obfuscation is the most common method of data masking, and it involves making the data difficult to understand.

Anonymisation, or data anonymisation
This is the process of transforming data in a way that preserves privacy. This transformation can be done by removing identifying information from the data or by encrypting the data.

How do I start data sanitisation in my organisation?

The first step is to conduct a data discovery exercise to identify where confidential data is stored within your organisation. Once you have identified the locations of confidential data, you can begin implementing data sanitisation policies and procedures. This should be conducted on a regular basis to ensure that data is properly protected.

How to choose a professional data sanitisation service?

When choosing a professional service, it is important to consider the type of data that needs to be sanitised and the level of security required. Data sanitisation services should be able to provide a certificate of destruction that verifies that data has been properly destroyed.

Data sanitisation services should be accredited by a reputable organisation, such as the National Association for Information Destruction (NAID). They should also have insurance to cover any damages that may occur during the data sanitisation process.

FAQs