Deletion certificate vs. certificate of data destruction.
Searching for either term returns results about the other. They sound alike and both end in an auditor's folder, but they answer different questions. A certificate of data destruction says a vendor destroyed media. A deletion certificate says a person's records are gone from systems that keep running. If you are handling a GDPR Article 17 or CCPA deletion request, you almost certainly need the second one: a certificate of data destruction satisfies an Article 17 request only if the person's data existed solely on the media that was destroyed, which is rare.
A note on the name. This page uses “deletion certificate” because it is the term people search for and the one that sits opposite “certificate of data destruction”. BurnLedger calls what it issues a Verification Record — no authority attests it, and calling it a certificate would imply one did. The comparison below is unaffected: it is about what each document proves, not what it is called.
What is a certificate of data destruction?
A certificate of data destruction (also certificate of sanitization, certificate of media destruction, or certificate of recycling) is issued by an IT asset disposition vendor after physically destroying or securely wiping storage devices: laptops, servers, drives, tapes. It typically lists the device serial numbers, the sanitization method and tool, the verification method, the date, the chain of custody, and the technician who performed and verified the work.
The reference standards are hardware standards. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, defines the sanitization program — clear, purge, destroy — and the minimum fields a certificate of sanitization should record; its 2025 revision defers technique details to IEEE 2883 and NSA specifications. Facility certifications such as NAID AAA (information destruction), R2v3 (electronics reuse and recycling, with data sanitization in its Appendix B), and e-Stewards attest that the vendor's process is audited. The document answers: was this equipment disposed of properly?
What is a deletion certificate?
A deletion certificate is issued after a specific data subject's records are removed from production systems — databases, object stores, search indexes, caches — that continue to operate afterwards. Nothing is shredded. The certificate records that matching records were present in the named systems at one moment and absent at a later one, signed by a party that observed both states. Because the systems keep running, the evidence has to be about queries rather than about media: the certificate names each system, records the hash of the query asked of it, and reports how many matching records existed before and after. That is a narrower claim than a destruction certificate makes, and deliberately so — it says nothing about stores nobody registered, or about copies the query does not reach. What it gains in exchange is checkability: two signatures over canonical bytes and an inclusion proof in a public log mean a third party can confirm the claim without trusting the party that made it.
The reference points are privacy law and cryptography: the right to erasure or deletion, the duty to demonstrate compliance, and a signature anyone can verify. The document answers: is this person's data gone? Details are in What is a deletion certificate?; the legal basis is in GDPR Article 17: how to prove erasure.
Side by side
| Certificate of data destruction | Deletion certificate | |
|---|---|---|
| Subject of the certificate | Physical media: drives, servers, tapes, devices | One person's records across live datastores |
| What happens to the system | It is destroyed or wiped and taken out of service | It keeps running; only the matching records are removed |
| Identified by | Serial numbers, asset tags | A hashed subject identifier, system IDs, query hashes |
| Typical trigger | Hardware refresh, decommissioning, lease return | An erasure or deletion request, account closure, retention expiry |
| Issued by | ITAD / recycling vendor | Independent verification service with read-only access |
| Governing references | NIST SP 800-88 Rev. 2, NAID AAA, R2v3, e-Stewards, ISO/IEC 27001:2022 Annex A 7.14 and 8.10 | GDPR Art. 17 & 5(2), CCPA §1798.105, Delete Act (SB 362) |
| How a reviewer checks it | Trusts the vendor's certification and paperwork | Verifies two Ed25519 signatures and a transparency-log inclusion proof, offline |
| Granularity | Per device | Per person, per system, per query |
The two documents, side by side
On the left, the fields NIST SP 800-88 lists for a certificate of sanitization, filled in for one drive. On the right, the same space taken up by the fields of a real BurnLedger certificate (the one annotated in What is a deletion certificate?). Neither column has anything to say in the other's rows.
CERTIFICATE OF SANITIZATION DELETION CERTIFICATE
(NIST SP 800-88, one drive) (BurnLedger verification record)
Make / model Seagate ST4000NM000A subject.identifier_hash 0b8cbe1d… (salted SHA-256)
Serial number ZC1A2B3C subject.identifier_type email
Media type magnetic, 3.5in HDD systems[0] postgresql query_hash 76386…
Source rack 12, decommissioned attested_count / at 42 2025-06-15T12:00:00Z
verified_count / at 0 2025-06-15T12:05:00Z
Sanitization PURGE (ATA Secure Erase) systems[1] s3 query_hash 073ca…
Tool / version blancco 8.4 attested_count / at 7 2025-06-15T12:00:00Z
Verification full read, 100% sampled verified_count / at 0 2025-06-15T12:05:00Z
Performed by J. Ortega (technician) attestation_signature Ed25519, signed before deletion
Validated by M. Reyes (supervisor) certificate_signature Ed25519, key dp_k_d59705f4…
Date 2025-06-15 issued_at 2025-06-15T12:05:01Z
Chain of custody asset tag 04471, sealed transparency log.burnledger.io entry #1
bin, pickup manifest #88 inclusion proof + signed head
Facility NAID AAA, R2v3 scope limitations text v1.0, hashed
Answers: was this drive disposed Answers: are this person's records gone
of properly? from these running systems?
Checked by: reading the paperwork, Checked by: re-running two signatures and
trusting the facility's a Merkle proof, offline, with
audited process the issuer's published keys
Silent about: any record in a system Silent about: any drive, any system not
that kept running listed, backupsThe certificate on the right names a Postgres database and an S3 bucket. If the drive on the left had held one of those systems, its destruction would still say nothing about the 42 rows and 7 objects, because they were replicated elsewhere and the systems kept running. The two documents are not competing formats for the same fact.
Which one do I need?
You are retiring hardware. Decommissioning a rack, returning leased laptops, disposing of backup tapes: you need a certificate of data destruction from the vendor doing the disposal. A deletion certificate has nothing to say about a drive.
Someone exercised their right to erasure or deletion. Their records live in systems you are not going to destroy. You need evidence that those specific records are gone from those specific systems: a deletion certificate. A destruction certificate for last year's decommissioned servers is irrelevant to this request.
A processor or vendor is ending its contract. GDPR Article 28(3)(g) requires them, at your choice, to delete or return your data and to delete existing copies. If they are wiping dedicated hardware, a destruction certificate covers that. If your data lived in their multi-tenant database, a destruction certificate says nothing about it; you need before-and-after evidence about those records — a deletion certificate. Contract language to require the second is in the Verifiable Deletion Addendum.
Why the confusion persists
Both documents descend from the same idea: an independent party attesting that data was disposed of. Destruction certificates came first because, for decades, destroying the media was the only way to make data reliably unrecoverable. Cloud infrastructure changed the shape of the problem. The drive under a Postgres row is shared, replicated, and never yours to shred; what you can do is delete the row, and what you need is proof that you did. The vocabulary is still catching up.
Can one certificate do both jobs?
No, and a document that claims to should raise questions. Media destruction is proved by custody and physical process; record deletion is proved by observing the system before and after. A deletion certificate that also asserted "all backups destroyed" would be claiming something its issuer did not observe. BurnLedger's certificates name the systems and query hashes they cover and nothing else; what that excludes is set out in What a certificate proves, and what it doesn't.
Common questions
Does a certificate of data destruction satisfy a GDPR Article 17 request?
Only if the person's data existed solely on the media that was destroyed, which is rare. Article 17 concerns the personal data itself, wherever it is held. For records in running systems you need evidence about those records: a deletion certificate.
Is a deletion certificate a NIST 800-88 document?
No. NIST SP 800-88 covers sanitization of storage media. A deletion certificate does not sanitize anything; it records that a query for a person's records returned results before a deletion and nothing after, under a verifiable signature.
Who issues each kind of certificate?
Certificates of data destruction come from the IT asset disposition or recycling vendor that handled the hardware. Deletion certificates come from an independent verifier with read-only access to the live systems — BurnLedger issues these — or, less usefully, from the company itself as a self-attestation.
Do I need a deletion certificate for every deletion request?
That is a policy choice. Many teams issue one for every fulfilled request so the evidence exists before anyone asks. Others reserve it for regulated data, disputes, or vendor offboarding. The cost of producing one after the fact is that the 'before' state can no longer be observed.