NCSRC NIRMATA
Home Guides Framework Start Assessment →
Home › Guides › Application & Product Security › AD-15
AD-15 Application & Product Security 6% of OML score

Is data securely deleted when it is no longer needed?

This question asks whether your company has a proper process to permanently remove data when it's no longer needed—not just deleting files from the trash, but making sure they cannot be recovered by anyone later. Many business owners don't realize that pressing 'Delete' doesn't actually wipe the data from the hard drive; a skilled person or hacker can often recover it months or years later.

⚡
Why This Matters to Your Business

If sensitive customer data, financial records, or employee information is deleted but not properly wiped, a data breach can expose your business to regulatory penalties under the Data Protection law, loss of customer trust, and potential lawsuits. For example, a manufacturing company in Bangalore deleted old customer invoices and employee records but did not securely wipe them; when their server was sold second-hand, the buyer recovered all the data and sold it to competitors, exposing pricing strategies and employee salary information. Without secure deletion, you remain liable for data you thought was gone, and auditors (including those checking your business for ISO 27001 or NIRMATA compliance) will flag this as a serious gap. Customers in regulated industries—pharma, finance, telecom—often audit their vendors and will penalize or terminate contracts if they find this control missing.

📊
What Each Maturity Level Looks Like

Find where your organisation is today. Be honest — the self-assessment is only useful if it reflects reality.

Level 0
Absent

You find that old hard drives, laptops, and storage devices with sensitive data are simply thrown away or given to employees without any wiping process. Your IT person (if you have one) deletes files when needed, but has never heard of secure deletion tools.

Level 1
Initial

You have an informal understanding that data should be deleted securely, but there is no documented process or standard tool in use. Some staff members try to delete sensitive files manually or use random free tools they find online, with no consistency or verification.

Level 2
Developing

You have a written policy that sensitive data must be securely deleted when no longer needed, and you use one free or paid tool (like CCleaner or DBAN) for occasional deletion tasks. However, the process is not regularly scheduled, and there's no log or verification that deletion actually happened.

Level 3
Defined

You have a documented data retention and secure deletion policy covering all types of data (customer, employee, financial). You use a consistent secure deletion tool, maintain logs of what was deleted and when, and test the tool annually to ensure it works. However, this is not yet automated or tied to your data lifecycle management.

Level 4
Managed

Your secure deletion process is formally documented, automated for common data categories (expired logs, old backups), and integrated into your data lifecycle system. You conduct quarterly audits to verify secure deletion has occurred, maintain detailed records, and train staff on the policy. You also securely wipe or destroy physical storage devices at end-of-life using documented procedures.

Level 5
Optimised

Secure deletion is fully automated, continuous, and embedded in your infrastructure and all applications. You have a data steward or dedicated role managing data retention and deletion. You conduct annual third-party audits of deletion effectiveness, monitor deletion compliance in real-time, and maintain an auditable chain of custody for all data destruction. Your policy covers data at rest, in transit, in backups, and on physical media.

🚀
How to Move Up — Practical Steps
StepWhat to DoWhoEffort
0 → 1 Meet with your IT person or hire a consultant for 2-4 hours to discuss what sensitive data you have, where it lives, and what a basic secure deletion approach could look like. Document this conversation as your first draft policy. Business Owner + IT Person/Consultant 1 day
1 → 2 Write a one-page Data Retention and Secure Deletion Policy that says what data must be deleted (customer PII, financial records, employee data), when (e.g., after 7 years), and which tool will be used (e.g., DBAN for drives, BleachBit for file-level deletion). Assign ownership to one person. IT Person + Compliance/Admin lead 1 week
2 → 3 Set up a monthly or quarterly secure deletion schedule using your chosen tool. Create a simple log (spreadsheet or email record) that documents: date, data type deleted, volume, tool used, and person who did it. Test the tool on a non-critical drive to verify it works. IT Person 2–4 weeks
3 → 4 Integrate secure deletion into your change management or IT operations workflow. For hardware end-of-life, create a checklist that requires evidence of secure deletion before disposal. Conduct an audit each quarter to verify logs are complete and deletion actually occurred. Train all relevant staff (IT, data handlers, admin) on the policy. IT Manager + Compliance lead 1–2 months
4 → 5 Automate secure deletion where possible (e.g., configure backup systems to auto-purge old backups, use OS-level encryption so deletion is cryptographically secure). Engage an external party annually to audit and verify your deletion process is working. Integrate deletion compliance into your IT governance dashboard. IT Manager + Data Steward (new or assigned role) Ongoing
📁
Evidence You Should Have

Documents and records that prove your maturity level.

  • A written Data Retention and Secure Deletion Policy document that lists data types, retention periods, and the tool(s) or method to be used
  • A log or record (spreadsheet, email trail, or tool report) showing dates, types of data deleted, volume, tool used, and who performed the deletion, covering at least the last 12 months
  • A copy of your secure deletion tool's documentation or installer (e.g., DBAN, BleachBit, Eraser) and evidence of its installation on company devices
  • A test report or email from your IT person confirming that the secure deletion tool was tested on a non-critical device and successfully wiped data (ideally using a recovery tool to verify the data could not be recovered)
  • An inventory or checklist of hardware end-of-life procedures that includes a step for secure deletion or certified destruction, signed off by IT, for at least 3 recent device disposals
🔍
What an Auditor Will Ask

Prepare for these questions from customers or third-party reviewers.

  • "Can you show me your data retention policy and explain which data is subject to secure deletion and when?"
  • "How do you actually delete sensitive data—do you just press Delete, or do you use a specific tool? Can you demonstrate it or show me proof it works?"
  • "Do you have records of when and what data was securely deleted in the past year? How do you know the deletion actually happened?"
  • "When you retire or dispose of a computer, hard drive, or storage device, what steps do you take to ensure the data on it cannot be recovered?"
  • "Has anyone audited or tested your secure deletion process to confirm it actually works, or do you just trust that it does?"
🛠
Tools That Work in India
PurposeFree OptionPaid Option
Securely erase entire hard drives or storage devices (wipes free space, making recovered data unrecoverable) DBAN (Darik's Boot and Nuke) — free, open-source, reliable for complete drive wiping Eraser (free and open-source), or commercial tools like Secure Eraser Pro (₹2,000–5,000 one-time) or KillDisk (₹8,000–15,000 per license)
Securely delete individual files and folders from computers without leaving traces BleachBit — free and open-source, works on Windows, Mac, Linux, clears file fragments and temp files CCleaner Professional (₹1,200–2,000/year) or Wise Care 365 (₹800–1,500/year)
Manage and audit deletion of data across multiple computers or servers; log and track what was deleted None reliable; use spreadsheets or simple database to log deletions Symantec Endpoint Encryption (₹15,000–30,000/year for small teams), or integrated features in MDM tools like Microsoft Intune (₹2,000–5,000 per device/year)
🛡
How This Makes You More Resilient
When you securely delete data that's no longer needed, you dramatically reduce the risk of a data breach exposing old customer or employee information, which cuts your liability under data protection laws and avoids damage to your reputation. This control also protects you during M&A, audits, or hardware disposal, because auditors and buyers will see that you follow proper data governance. If a breach does happen, you can confidently say that old data was already wiped, limiting the scope and severity of the incident.
⚠️
Common Pitfalls in India
  • Relying on 'Shift+Delete' or the Recycle Bin, which does not actually remove data from the disk — recovery software can still retrieve it weeks or months later
  • Buying second-hand computers or selling old servers without wiping them first; many Indian small businesses have been caught when buyers recovered customer data and used it to solicit clients
  • No documentation or log of what was deleted and when, making it impossible to prove to auditors or regulators that you actually deleted the data
  • Throwing away or donating hard drives to schools or charities without secure wiping, leading to unintended data disclosure and reputational damage
  • Using unreliable or untested deletion methods (like encrypting and then deleting the key) without verifying that the data truly cannot be recovered
⚖️
Compliance References
StandardRelevant Section
DPDP Act 2023 Section 10 (data principal's rights) and Section 8 (lawfulness of processing) require that personal data be retained only as long as necessary and deleted when no longer required; Section 12 recognizes the right to erasure
CERT-In 2022 Direction 4 (secure handling of personal data) mentions secure deletion of data no longer needed to prevent unauthorized access
ISO 27001:2022 Annex A, Control A.5.3 (Removal of access rights) and A.8.2.3 (Handling of assets) require procedures for secure disposal or wiping of media containing sensitive data
NIST CSF 2.0 Govern Function (GV.PO-04: Data governance practices for asset management) and Protect Function (PR.DS-03: Data is removed or rendered inaccessible)

Ready to assess your organisation?

Answer all 191 questions and get your NIRMATA maturity score across all 12 pillars.

Start Free Self-Assessment →

TRUST-IN Bharat · NIRMATA Framework · Licensed CC BY-SA 4.0 · Custodian: Elytra Security

← Back to all guides  ·  trustinbharat.org