What is a chain of custody and why is it so important?

A hard drive may ultimately be securely wiped or destroyed. But what happened to it in the hours or days beforehand? Where was it stored? Who had access to it? And at what point did the processing partner take responsibility for data destruction?

Secure data destruction is not just about the end result. The steps a laptop, server or data storage device goes through beforehand must also be controlled.

This is where the chain of custody comes in.

A chain of custody is the verifiable path that IT equipment and data storage media follow throughout processing.

The principle is simple: handovers, responsibilities and the processing carried out must be clearly documented.

This reduces the risk of losing track of data storage media during storage, transport or processing, or of them becoming accessible to unauthorised people.

A chain of custody is therefore more than paperwork. It is part of a controlled process for keeping data secure.

A great deal of attention is paid to the technique used to ultimately remove data. Yet risks can arise before data destruction actually takes place.

Consider laptops stored unattended, or a box of hard drives with no clear record of when it was handed over or to whom. Even if those storage media are subsequently processed correctly, there may have been a period of insufficient control beforehand.

A good chain of custody limits this risk by establishing clear agreements on handover, transport, access, processing and responsibility.

Not every organisation has the same security requirements. This means the process does not have to be the same for everyone either.

For example, an organisation may remove the data itself before handing over the equipment. Another option is for Out of Use to carry out data destruction after the equipment has been received at the processing centre.

Organisations seeking greater control during transport can choose an arrangement in which Out of Use takes responsibility for data destruction from the moment the equipment leaves the customer’s premises, for example through sealed transport.

For sensitive environments, data destruction can also take place directly at the customer’s site. The storage media then do not need to leave the premises before the data has been processed.

What matters is agreeing clearly in advance who takes on which responsibilities, from what point, and which security measures apply.

A controlled process is important, but it must also be possible to clearly demonstrate afterwards what happened to the equipment.

Reports and a certificate of destruction can help with this. Where more detail is required, devices or storage media can be individually logged. Their serial numbers are then linked to the reports, allowing individual devices or storage media to be identified.

For IT managers, security teams and DPOs, this provides valuable documentation of the processing carried out.

A good chain of custody does not mean that every organisation automatically needs to choose the strictest security measures.

The right approach depends on the sensitivity of the data, internal procedures, the type of equipment and the desired level of control. This principle also aligns with the risk-based approach of both the GDPR and current guidelines on secure data removal, such as NIST SP 800-88 Rev. 2.

Out of Use tailors the process to the organisation’s security requirements and internal procedures. This allows clear agreements to be made on handover, transport, data destruction and reporting.