Two things go wrong at the end of a device’s life, and they go wrong in different directions. The data does not get destroyed properly, which is a Privacy Act problem and potentially a notifiable breach. And the hardware ends up somewhere it is not allowed to be, which in Victoria has been illegal since 2019. A disposal process has to solve both, and most SMB processes solve neither.
Media sanitisation is the process of removing data from storage media so that it cannot be reconstructed. Destruction is physically rendering the media unusable. They are different controls, they suit different devices, and they produce different evidence.
A factory reset is a convenience feature, not a data destruction control
A factory reset is designed to make a device usable by the next person quickly. On most operating systems it removes the file system pointers and the user profile. Whether it removes the data depends entirely on the underlying storage and whether encryption was in play.
The Australian Signals Directorate’s Information Security Manual sets out why a straightforward overwrite is not sufficient on a spinning disk. Modern magnetic hard drives keep a host-protected area and a device configuration overlay table that are normally invisible to the firmware and the operating system, so sanitising the readable sectors leaves anything in those regions untouched. They also reallocate bad sectors into a growth defects table, and data written to a sector before it was reallocated will not be overwritten by ordinary software. The ISM’s answer is to reset the host-protected area and device configuration overlay first (control ISM-1065), and to use the ATA secure erase command in addition to block overwriting software so the growth defects table is covered (ISM-1067).
Flash memory has a different problem. Wear levelling deliberately spreads writes across memory blocks, so a single pass has no guarantee of touching every block. The ISM requires non-volatile flash memory media to be overwritten at least twice in its entirety with a random pattern, followed by a read back for verification (ISM-0359). For hybrid drives, it requires separating the magnetic media from the circuit board holding the flash and sanitising each separately.
The ISM is written for government systems, not for private businesses. The OAIC’s own APP 11 guidance points to the ISM’s media sanitisation section and notes that although it applies to Australian Government agencies, it may be of interest to organisations complying with APP 11.2. That is as close to a benchmark as an Australian SMB is going to get, and it is a good one to be measured against in an audit.
Three methods, and when each is defensible
Factory reset or an OS-level wipe. Acceptable only for a device that was fully encrypted from first use and is staying inside your organisation. Not acceptable as the sole control for a device leaving your custody.
Cryptographic erase. The drive is encrypted, and you destroy the key rather than the data. NIST SP 800-88 Rev. 1 recognises cryptographic erase as a purge technique. It is fast, it works at scale, and it is the mechanism behind Apple’s “Erase All Content and Settings” on Macs with Apple silicon or the T2 chip and on iPhones and iPads, where the volume key is held in dedicated hardware and destroyed on erase. Two conditions have to hold: encryption must have been enabled from the moment the device was first used, and you must trust the firmware implementation. If the device spent its first year unencrypted, cryptographic erase does not reach the data written during that year. Note also that the ISM’s sanitisation controls are built around overwriting and use ATA secure erase in addition to, not instead of, software overwriting.
Physical destruction. The only method that does not depend on trusting firmware. The ISM specifies destruction methods by media type (furnace or incinerator, hammer mill, disintegrator, grinder or sander, degausser, or cutting depending on the media) and requires resulting particles to be no larger than 9 mm. It requires the use of Security Construction and Equipment Committee-approved or ASIO-approved equipment, and where a degausser is used, it also requires the platters to be physically deformed afterwards. Destruction is the right answer for any drive that failed, that cannot be verified, or that held sensitive information. The ISM is explicit on this point: media that cannot be successfully sanitised is destroyed prior to disposal (ISM-1735).
The trade-off is straightforward. Destruction gives you certainty and destroys residual value. Sanitisation preserves the resale or redeployment value of the asset and puts the burden of proof on you. Decide per device class, write the decision down, and stop making it case by case at the loading dock.
SSDs, spinning disks, phones and the printer everyone forgets
Spinning disks. Sanitise with a tool that resets the host-protected area and device configuration overlay and issues ATA secure erase, then verify with a read back. If verification fails, destroy it. Old drives under 15 GB or manufactured before 2001 need three overwrite passes under the ISM rather than one.
SSDs and NVMe. Prefer cryptographic erase where the drive was encrypted from day one, or the manufacturer’s sanitise command. Software overwriting alone is unreliable because of wear levelling and over-provisioning. If the drive held anything sensitive and you cannot verify the erase, destroy it. SSDs shred easily and cheaply.
Phones and tablets. Remove them from your MDM and from Apple Business Manager or the Android enterprise equivalent before wiping, then perform the vendor erase. A device still enrolled or still tied to an activation lock is not disposable and is not resellable, and this is the single most common failure we see. Personal devices under a BYOD arrangement need a documented selective wipe that removes corporate data without touching the owner’s photos.
Multifunction devices. This is the one everyone forgets. Business photocopiers and multifunction printers commonly contain an internal hard drive or SSD that has retained images of everything scanned, printed, faxed and emailed through them, sometimes for years. When the lease ends the machine goes back to the finance company with that drive inside it. Before any MFD leaves the building, either have the vendor perform and certify a documented data removal, or buy the drive out of the lease and destroy it yourself. Put this in the lease negotiation, not in the exit conversation.
Everything else with storage. Network video recorders, backup appliances, firewalls with logging, VoIP handsets with local directories, USB sticks in the bottom drawer, and the old NAS in the comms room. If you do not have an asset register that actually tracks devices, you will miss several of these, and the ones you miss are the ones that turn up on a marketplace listing.
The Privacy Act requires you to destroy what you no longer need
APP 11.2 requires an APP entity to take such steps as are reasonable in the circumstances to destroy personal information or ensure it is de-identified once the information is no longer needed for any purpose for which it may be used or disclosed under the APPs, unless an Australian law or a court or tribunal order requires it to be retained. APP 11.3, introduced by the Privacy and Other Legislation Amendment Act 2024 and applying to personal information held from 11 December 2024, confirms that reasonable steps include both technical and organisational measures.
Three points from the OAIC’s guidance change how a disposal process should be built.
Destruction means the information can no longer be retrieved. The OAIC states that for hard copy, disposal through garbage or recycling is not reasonable steps unless the information has already been pulped, burnt, pulverised, disintegrated or shredded. For electronic information, reasonable steps vary with the hardware, and where hardware cannot be sanitised, the information must be irretrievably destroyed another way.
You must deal with all copies, including archives and backups. A wiped laptop does not help if the same personal information is sitting in a backup set you have kept for six years without a retention policy.
Where the information sits on a third party’s hardware, such as cloud storage, and you have instructed them to destroy it, reasonable steps include taking steps to verify that it happened. That is the same discipline as asking where your cloud data actually lives at the start of the relationship.
There is also a fallback the OAIC calls putting information beyond use, for the limited cases where irretrievable destruction is genuinely impossible. It requires that you will not use or disclose the information, cannot give any other entity access to it, surround it with technical, physical and organisational security including access logs and audit trails, and commit to destroying it when that becomes possible. It is a narrow exception, not a filing strategy.
Get this wrong and a lost or stolen device holding personal information is exactly the example the OAIC gives of a notifiable data breach. Knowing which machines held what makes that assessment survivable, which is the practical reason to know which devices held sensitive information before they reach end of life.
Certificates of destruction, and what a real one contains
Most certificates of destruction we see are marketing documents. A useful one is an evidence record. It should contain:
- The serial number of every item, matched to your asset register, not a count of items or a weight
- The media type and the method used for each item, not a generic statement covering the batch
- The date and physical address at which destruction or sanitisation occurred
- The name and signature of the person who performed it and the person who witnessed it
- For sanitisation, the tool and version used and confirmation that verification passed
- For destruction, the equipment used and the resulting particle size
- A statement of the standard the vendor worked to
- Confirmation that the residue was then handled as e-waste under Victorian law
If the certificate cannot be reconciled to serial numbers in your asset register, it proves nothing in an audit. The ISM’s own approach for government is instructive: destruction is supervised, the supervisor confirms it was completed successfully, and where destruction of sensitive media is outsourced it requires a National Association for Information Destruction AAA certified service. Asking a commercial vendor whether they hold NAID AAA certification is a fast way to sort the serious operators from the rest.
Chain of custody is where it actually fails
The data is rarely lost during destruction. It is lost between the desk and the truck.
Devices sit in a store room for eight months. A staff member takes one home because it was “going to be thrown out anyway”. The pallet is collected by a subcontracted driver nobody recognises. A box goes missing between sites and nobody notices because there is no manifest.
Fix it with unglamorous controls. Log every device into a disposal batch at the moment it is decommissioned, with its serial number. Store the batch in a locked area, not the corridor. Do not release a batch without a signed manifest listing every serial. Require the vendor to acknowledge receipt against that manifest within an agreed window, and chase it when they do not. Reconcile the certificate to the manifest and close the batch in your asset register. That whole loop belongs in a documented disposal procedure so it survives the departure of whoever currently does it from memory.
Where devices held highly sensitive information, remove and destroy the drives on site before the hardware leaves, and let the vendor take the carcass. It is cheap and it eliminates the entire chain of custody argument.
Victoria banned e-waste from landfill in 2019
Since 2019 it has been illegal in Victoria to send e-waste to landfill or put it in general rubbish. E-waste is broadly defined: anything with a plug, a battery or a power cord. That includes computers, phones, monitors, whitegoods, batteries and photovoltaic panels.
For a business the obligations go further than “do not bin it”. EPA Victoria regulates the transport, storage and reprocessing of industrial waste, and most e-waste from business and industry is pre-classified as priority waste under Schedule 5 of the Environment Protection Regulations 2021. Duties under the Environment Protection Act 2017 apply to the generator, the transporter and the receiver, which means you carry a duty as the generator and cannot fully delegate it. The general environmental duty applies as well: you must eliminate or reduce the risk of harm from your e-waste so far as reasonably practicable. Used lead-acid and nickel-cadmium batteries are classified as reportable priority waste and attract additional requirements.
Lithium-ion batteries deserve a specific mention. EPA Victoria’s guidance is to manage all e-waste as if it has a battery, and e-waste is treated as a specified combustible recyclable and waste material. A crate of old laptops and vapes in a comms room is a fire load, not just a compliance item.
The relevant Australian Standard is AS 5377:2022, which covers the collection, storage, transport and treatment of end-of-life electrical and electronic equipment. Ask your vendor whether they work to it.
Who to contact now that Sustainability Victoria has closed
Sustainability Victoria closed on 30 June 2026 following the Independent Review of the Victorian Public Service, and its website is no longer updated. Programs that continued, including Detox Your Home and the recycling infrastructure funding streams, transferred to the Department of Energy, Environment and Climate Action (DEECA). For current Victorian information on recycling and waste, go to DEECA. For the rules themselves, and for enforcement of the e-waste landfill ban, go to EPA Victoria. Anything still citing Sustainability Victoria as the authority is out of date.
At Commonwealth level, the Product Stewardship Act 2011 was repealed and replaced by the Recycling and Waste Reduction Act 2020, with the repeal effected by the accompanying Consequential and Transitional Provisions Act. The National Television and Computer Recycling Scheme continues under that framework, administered by the Department of Climate Change, Energy, the Environment and Water, which has also committed to developing a mandatory product stewardship scheme covering small electrical products and solar photovoltaic systems. If a supplier quotes the Product Stewardship Act 2011 at you, they have not updated their paperwork since 2020.
What to require from a disposal vendor
Put these in the engagement, not in an email thread.
- Which EPA Victoria permission they hold, or which permissioned facility their material goes to
- Whether they work to AS 5377:2022, and whether they hold NAID AAA certification for data destruction
- Whether destruction happens on your site, at their site, or at a third site, and who transports it
- What the certificate of destruction contains, with a sample provided before you sign
- Serial-level reconciliation against your manifest, with a stated turnaround
- What happens to devices they on-sell rather than destroy, and what sanitisation they apply first
- Whether any material is exported, and to where
- Their insurance position if a device holding your data surfaces after they took custody of it
The last one is the question that separates a disposal partner from a scrap dealer.
We handle decommissioning, drive destruction and compliant e-waste disposal as part of asset lifecycle work for our managed clients, including the MFD lease exits that usually get missed. If you have a store room full of retired kit and no record of what is in it, call us on 1300 028 324 or get in touch at https://techassist.au/contact/. We will inventory it, tell you what is defensible to sanitise and what has to be destroyed, and give you your Privacy Act obligations in writing rather than in principle.
