Hard drive shredding certifications show that an independent auditor has checked how a company collects, stores and destroys your drives. In the UK, the most useful ones to look for are ADISA, BS EN 15713 and ISO 27001, plus a stated shred size under ISO/IEC 21964. Whatever the certificate, always check it is current and covers hard drive destruction.

Any company can say it shreds hard drives securely. A certification means someone else has checked. This guide explains the main certifications, what each one actually proves, and how to check a supplier before you hand over your drives.

If you also need to show compliance with on-site shredding, the same checks apply.

What are Hard Drive Shredding Certifications?

A hard drive shredding certification is an independent check of a shredding company’s processes. Auditors look at how drives are collected, stored, tracked, destroyed and recorded, and whether staff are vetted and trained.

Under UK GDPR, you must choose a provider that keeps your data safe. A recognised certification is the easiest way to show you did this. It protects your customers from data breaches and identity theft, and protects your business if the ICO ever asks questions.

Certification vs Certificate of Destruction

These are two different things. A certification is about the company and how it works. A certificate of destruction is about your job: the date, the method, and ideally the serial number of every drive.

You need both. Our guide to GDPR and shredding certifications explains what records to keep.

ADISA and NAID AAA Certification

These two certifications focus specifically on data destruction and IT disposal companies. One is UK-based, the other is US-based.

ADISA ICT Asset Recovery Standard

ADISA is a UK certification body for companies that dispose of IT equipment and destroy data. Its ICT Asset Recovery Standard 8.0 was approved by the ICO as a UK GDPR certification scheme in 2021, and updated again in 2026.

The standard checks the whole process, not just the shredder:

• How drives are collected and transported
• How they are stored and tracked
• How data is wiped or destroyed
• How equipment is recycled or resold
• How staff are vetted and trained

Because it is ICO-approved, choosing an ADISA-certified provider is one of the strongest ways to show you met your UK GDPR duties when disposing of drives.

NAID AAA Certification

NAID AAA is run by i-SIGMA, a US-based trade association formed in 2018. Certified companies face both scheduled and surprise audits covering staff screening, site security, equipment and procedures.

It is a respected certification, but it is far more common in the US than the UK. If a UK provider does not hold NAID AAA, that is not a warning sign on its own. ADISA, BS EN 15713 and ISO certificates show the same kind of checks for the UK market.

ISO Certification

There is no single “ISO certificate” for hard drive shredding. Several ISO standards apply, each checking something different. When a supplier says they are ISO certified, ask which ones.

ISO 27001, ISO 9001 and ISO 14001

• ISO 27001. Information security. Shows the company protects data across its whole business, from IT systems to building access.
• ISO 9001. Quality management. Shows every job follows the same checked process.
• ISO 14001. Environmental management. Shows shredded material is recycled responsibly.

Alongside these, BS EN 15713 is the British Standard for secure destruction of confidential material, covering collection, storage, transport and destruction.

ISO/IEC 21964: Hard Drive Security Levels

ISO/IEC 21964 (based on the German DIN 66399 standard) sets how small the pieces must be after shredding. For hard drives, the levels run from H-1 to H-7:

• H-1 to H-2: drive made unusable or damaged. Only for general, low-risk data.
• H-3: drive deformed. The usual minimum for personal and confidential data.
• H-4: pieces no bigger than 2,000mm². For particularly sensitive data.
• H-5: pieces no bigger than 320mm². For highly confidential data.
• H-6 to H-7: very fine pieces for top secret and classified data.

SSDs use a separate scale (E-1 to E-7), because their memory chips are tiny and need much smaller shred sizes. Ask your provider which level they shred to for both types. Our guide to secure data destruction methods explains the options.

Certifications for Specific Industries

All UK businesses follow UK GDPR and the Data Protection Act. Some sectors have extra expectations on top.

UK Healthcare, Finance and Public Sector

• Healthcare. Organisations that handle NHS patient data complete the NHS Data Security and Protection Toolkit, which includes how data is destroyed. Choose a provider with ADISA or ISO 27001 so your evidence is ready.
• Finance and legal. Regulators expect firms to manage the risks of outside suppliers. Certified destruction with serial-level certificates makes this easy to show.
• Public sector. Many contracts ask suppliers to hold Cyber Essentials or ISO 27001, and to follow NCSC guidance on sanitising storage media.

You may see US rules such as HIPAA and FACTA on other sites. They only apply to US data and do not cover UK businesses.

Choosing the Right Certification for Your Needs

The right choice depends on what your drives hold. For most businesses with staff and customer records, look for ADISA or BS EN 15713, plus ISO 27001, and shredding to at least H-3.

If your drives hold financial, medical or legal data, ask for H-4 or H-5, serial number recording and, ideally, on-site shredding so the drives never leave your sight. You can see how this works in our hard drive shredding process guide.

Factors to Consider

A logo on a website is not proof. Before you book, check these points:

• Ask for the certificate number and the name of the body that issued it.
• Check it is current. Certificates expire, so look at the expiry date.
• Check the scope. The certificate should cover hard drive or media destruction, not just paper or an office.
• Check ISO certificates on UKAS CertCheck, the UK’s database of accredited certificates.
• Ask what shred size they use for hard drives and SSDs.
• Ask for a sample certificate of destruction and whether it lists serial numbers.
• Check their waste carrier licence on the Environment Agency register.

For more help, read our guide on how to choose the right hard drive shredding company.

Need Certified Hard Drive Destruction?

Total Shred provides on-site and off-site hard drive destruction for businesses across London and the South East, working to BS EN 15713, ISO 9001 and ISO 14001. Every job comes with a certificate of destruction, and all material is recycled.

Get a quote or call 0800 298 4009.

Frequently Asked Questions

What certifications should a UK hard drive shredding company have?

Look for ADISA or BS EN 15713, plus ISO 27001 for information security. ISO 9001 and ISO 14001 are good signs too. The company should also hold a waste carrier licence.

Is NAID AAA certification recognised in the UK?

Yes, but it is a US-based scheme and far less common here. ADISA, BS EN 15713 and ISO certificates are what most UK buyers ask for.

What is ADISA certification?

ADISA is a UK certification for companies that dispose of IT equipment and destroy data. Its ICT Asset Recovery Standard is approved by the ICO as a UK GDPR certification scheme.

What size should hard drives be shredded to?

For personal and confidential data, ISO/IEC 21964 level H-3 is the usual minimum. For highly sensitive data, ask for H-4 or H-5, which produce smaller pieces.

How do I check a shredding company is really certified?

Ask for the certificate number, issuing body and expiry date, and check the scope covers hard drives. You can check ISO certificates on UKAS CertCheck.

Is shredding a hard drive safer than wiping it?

Yes, for drives you are getting rid of. Wiping overwrites the data but leaves the drive intact, and can fail on damaged drives. Shredding physically destroys the drive, so nothing can be recovered. See our guide to hard drive shredding vs wiping.