DPDP Act Data Destruction Requirements in India

The most common misunderstanding about the Digital Personal Data Protection Act 2023 and data destruction is that it prescribes a technology. It does not. There is no clause naming degaussing, shredding or any other method.

What the Act does is make two things your responsibility: honouring erasure requests, and deleting personal data once its lawful purpose is met. And it makes you accountable when that fails. So the defence is not a machine — it is a documented, repeatable, demonstrable process. A degausser is simply the most reliable way to demonstrate purge for magnetic media.

The two obligations that create deletion duties

Purpose limitation. Personal data is processed for the lawful purpose for which it was collected. When that purpose is exhausted, the data must be deleted unless a law requires retention. This is what creates the obligation to destroy media at end of life, not merely to stop collecting.

Erasure with intent. A data principal can require erasure, and the data fiduciary must have a system that honours it — which the Rules place responsibility for on the Data Protection Officer. If a copy of the same personal data still exists on a retired drive in a warehouse, erasure has not really been delivered.

Where the real risk actually sits

Almost every genuine exposure has come from hardware, not from a database:

• A decommissioned server drive sold or donated "without thought", still holding customer and employee records.
• A laptop handed to a second owner under a buy-back scheme, with email, saved credentials and documents intact.
• A failed drive in the e-waste bin, later recovered — a single surviving platter surface can yield readable data.
• Backup tapes in an off-site rack, holding a full copy of production, retained indefinitely by nobody's decision.
• Flash media — SSDs, phones, pen drives — passing through every drawer of the building untouched by any process.

The checklist

What a defensible process contains, in the order you should build it:

1. A written media disposal policy that names a method per media class, not a general statement about secure disposal.
2. An asset register of every medium in scope — serial number, asset tag, data classification, custodian, location.
3. Named media classes including flash and tape. If the policy does not name SSDs, phones and backup cartridges, they are out of scope, and that is the finding.
4. Degaussing for magnetic media, to NIST SP 800-88 purge level, with per-cycle verification where the machine provides it.
5. Physical destruction for flash — shredding. No magnetic method applies to flash and no software method is dependable.
6. Physical destruction of sanitised magnetic media where policy requires a second barrier.
7. A per-asset destruction register with date, asset tag, serial, media type, classification, machine, verification value, method, operator signature and custodian signature.
8. Segregated, labelled media bins, so a drive cannot reach general waste.
9. Authorised e-waste recycler documentation, linked to the batch, per the E-Waste (Management) Rules.
10. A retention rule for the register itself, aligned to the longest personal-data retention period in your organisation.
11. Named operators, with training records.
12. An annual review, plus a trigger after any incident or audit finding.

Method by media class

Get this mapping right in the policy and most of the ambiguity disappears:

— Hard disk drives, server drives, failed drives: degauss, then crush. A degausser handles failed drives, which a shredder often cannot grip and software erase cannot touch at all.

— LTO, DLT, DAT tapes: degauss, then crush. The most overlooked category, because nothing generates a log entry.

— SSDs, M.2, NVMe, pen drives, memory cards: shred. There is nothing magnetic to destroy. Over-provisioned areas and wear levelling mean a logical overwrite is not dependable either.

— Phones, tablets, handhelds, POS devices: shred after removing batteries. If the device is being retained or re-issued, a documented reset process applies instead.

— SIM cards, credit, debit and ID cards, optical media: shred.

On retention periods

There is a trap here worth naming. If you destroy media before a retention obligation expires, you have created a records problem. If you keep media after it expires because nobody made the decision, you have created a data-protection problem.

That is why the retention schedule needs to reach the media, not just the database. The register's own retention should be aligned to the longest period you are required to keep the underlying data — commonly three to seven years in a regulated Indian organisation.

What an auditor will actually ask

• Show me the media disposal policy, with its version history.
• Show me the destruction register for a sampled period — not a summary, the register.
• How do you know the degausser actually delivered the field?
• What happens to a failed drive?
• Where do your backup tapes go, and who authorised their retention?
• How are SSDs and phones handled? Show me.
• Who is authorised to operate the machine, and are they trained?
• Who took the scrap, and can you show they are an authorised recycler?

Every one of those is answerable in a sentence if your process is documented, and none of them is answerable if it is not.

The equipment implication

Once the policy names the methods, the equipment follows. A two-machine cell covers everything: a Proton T-1.5 or T-5 for magnetic media with per-cycle verification, a PDS-100 for physical destruction, and a PDS-88 for flash. Organisations with a low volume can achieve the same outcome without capital outlay — see the on-site destruction service, which produces the register as the deliverable.