Why a verbal promise is not enough
Under the GDPR and standards such as ISO 27001, your organisation remains responsible for data on devices until it is demonstrably gone. An auditor will therefore ask for documents, not assurances.
The evidence that matters
1. An asset list: every device with brand, model and serial number, ideally exported from your asset management system.
2. A record per device: for each serial number, whether the data carrier was wiped with certified erasure software or physically destroyed.
3. A certificate: an erasure or destruction certificate that lists those serial numbers, so each line on your asset list can be matched.
4. Process assurance: evidence that the party handling your equipment works under a certified information security management system.
How itbuyer.eu documents this
itbuyer.eu is a trading name of 7Digits B.V., ISO 27001:2022 certified (Kiwa-audited). Data carriers are wiped with certified erasure software, or physically destroyed on request.
You receive a destruction certificate per serial number, optionally with photos. Equipment is processed at our secured facility in Pijnacker (NL), with CCTV, badge access, screened staff and our own vehicles.
Checklist before devices leave your building
Export the asset list with serial numbers, remove devices from device management (MDM) and accounts, state in your quote request whether you need wiping or physical destruction, and agree in advance which documents you will receive.