Ask ten IT managers what ISO 27001 hard drive destruction means and most will describe a shred size. Six millimetres. Two millimetres. Whatever the last supplier quoted.

The standard specifies no millimetres. Not one number.

ISO 27001 does not give you a specification to buy against. It requires you to show that you decided how far destruction needed to go, that you can justify why, and that you hold the records to prove it. Auditors examine the paper trail behind your storage devices at least as closely as the devices themselves.

Quick answer: ISO 27001 hard drive destruction has no fixed shred size. You choose a destruction level that matches how sensitive your data is (most UK contracts use DIN 66399 level H-5 for hard drives and E-4 or E-5 for SSDs), appoint a supplier you can monitor, and keep serialised certificates that match your asset register.

What ISO 27001 Hard Drive Destruction Requires

The 2022 revision spreads the requirement across several Annex A controls.

Control 7.14, secure disposal or re-use of equipment. Equipment holding storage media must be checked before it leaves service, so that sensitive information and licensed software are removed, overwritten or destroyed. Asset tags identifying your organisation should also be removed.

Control 7.10, storage media. A documented approach to media across its whole life, disposal included, in proportion to how sensitive its contents are.

Control 8.10, information deletion. Information is deleted when it is no longer needed, in a way that leaves it unrecoverable.

Control 5.9, inventory of information and other associated assets. This causes more audit findings than the others combined. A drive on your asset register with no matching destruction record is a gap nobody can argue with.

Controls 5.19 to 5.22, supplier relationships. Once you appoint a hard drive destruction service, their process becomes your risk. Your agreement must set out what they will do, and you must check that they do it. Our guide to hard drive shredding certifications explains how to check a supplier.

Read together: deletion alone is not enough, physical destruction applies where reliable erasure cannot be achieved, and the method must match the sensitivity of the data.

Shred Sizes: Where the DIN 66399 Levels Come From

Because ISO 27001 sets no size, the industry adopted one. Almost every quote for a hard drive shredding service is priced against DIN 66399, published internationally as ISO/IEC 21964.

That standard grades destruction from level 1 to 7 across different types of media. Magnetic hard disks fall under H, solid state devices under E and paper under P, which is why the same framework also governs security document destruction.

For magnetic disks, H-4 caps particle area at 2,000 mm² for sensitive commercial data. H-5 tightens this to 320 mm², covering most personal, financial and health records. H-6 reaches 10 mm² and H-7 5 mm² for classified material.

Solid state media runs on a separate scale, because NAND chips behave nothing like platters. E-3 allows 160 mm². E-4 cuts this to 30 mm², the common commercial baseline for SSDs. E-5 reaches 10 mm² where personal or financial data is involved.

Most UK contracts settle on H-5 for spinning disks and E-4 or E-5 for solid state. That is a default, not a rule. When clients come to Total Shred without a stated level, we work backwards from the classification of the data, rather than quoting a level and letting price decide.

BS EN 15713:2023 is the European code of practice for physical destruction of confidential material. It is aligned to GDPR and ISO/IEC 27001, and deliberately excludes erasure methods. NIST SP 800-88 Rev. 2, updated in September 2025, takes a different route, sorting sanitisation into Clear, Purge and Destroy.

ISO 27001 Hard Drive Destruction for HDDs and SSDs

A degausser floods a magnetic platter with a field strong enough to scramble the recorded data. On a traditional hard drive, this works. On an SSD, it achieves nothing, because there is no magnetic surface to disturb.

Overwriting is not a clean answer for solid state either. Wear levelling moves data across chips, spare blocks sit outside the space the computer can reach, and the controller can retire a bad block with your data still inside it. A single-pass overwrite can leave readable fragments in cells the operating system never touches. Our guide to hard drive shredding vs wiping covers this in more detail.

That leaves two credible options. The first is cryptographic erasure, on a drive encrypted from day one, with verified key destruction. The second is physical destruction fine enough to break apart individual NAND chips, not just separate them from the board. A shredder rated H-5 is not automatically rated E-4, so ask explicitly.

Software erasure works on both drive types, but it depends on the drive responding, so faulty units cannot be verified at all. Degaussing covers magnetic drives and tape only, and leaves no visible sign that anything happened. NIST’s 2025 update is also more cautious about relying on it. Shredding handles every media type and produces the strongest evidence, at the cost of any resale value.

Chain of Custody Is Where Audits Fail

Your storage devices are most at risk between the server room and the shredder. That gap is what an auditor probes hardest, and it is the part of data destruction services most often bought on price alone.

A chain of custody that stands up to audit records the serial number of every drive at collection, not at destruction, so the record does not depend on the supplier. Media travels in sealed, tamper-evident containers. Vehicles are tracked and drivers are vetted. Every handover is signed. The certificate lists individual serial numbers, not a headline count.

That last point matters. A certificate stating “47 hard drives destroyed” tells an auditor nothing about whether drive 31 from your register was among them. A serialised certificate closes the loop between control 5.9 and control 7.14 in one document, which is why Total Shred issues certificates listing serial numbers. Our vehicles also carry cameras covering the full shredding process, so evidence can be requested for a specific job.

On-site destruction removes transport risk entirely. Off-site processing at a secure facility is cheaper, usually achieves finer particle sizes, and stays defensible where custody controls are in place. Total Shred offers both, and our guide to hard drive disposal options compares them.

The Evidence Pack Your Auditor Will Request

Have these ready before your audit:

• A disposal policy stating which method applies to which data classification, and why
• The risk assessment justifying your chosen destruction level
• An asset register that reconciles cleanly against destruction records
• Serialised certificates of destruction for every batch
• Collection notes and signed handover records
• Your supplier’s current certifications and your due diligence records
• The processor agreement required under UK GDPR Article 28
• Waste carrier registration, waste transfer notes and WEEE compliance evidence

The last item catches people out. Secure data destruction and waste disposal are legally separate duties, and meeting one does not meet the other. Our guide to e-waste disposal and hard drive shredding explains the waste side.

 What UK GDPR adds

ISO 27001 certification is voluntary. UK GDPR is not, and the two overlap when equipment reaches the end of its life.

Article 5(1)(f) requires appropriate security of personal data, and Article 32 requires measures in proportion to the risk. Article 28 requires a written contract with any processor, and a company shredding your drives is processing personal data on your behalf. Our guide to GDPR and shredding certifications covers what to keep on file.

The ADISA ICT Asset Recovery Standard 8.0 was approved by the ICO in July 2021 as a UK GDPR certification scheme under Article 42, and was updated in March 2026 to reflect the Data (Use and Access) Act 2025. Appointing a certified provider gives a controller documented evidence of the “sufficient guarantees” Article 28 requires.

The ICO’s own guidance on disposal and deletion is a useful checklist to run your process against.

 Four failures that keep recurring

• Drives disposed of before the asset register was updated. The register still lists them. Nothing else does.
• A certificate with no serial numbers. It proves something was destroyed, and nothing about what.
• SSDs run through an HDD process. Shredded to a size suitable for platters, and nowhere near fine enough for NAND chips.
• Printers and copiers left out of scope. Almost all contain an internal drive, and almost nobody remembers at lease return.

 Getting the specification right

Decide what your data is worth, choose a destruction level that matches, appoint a hard drive destruction service that can evidence its own controls, and keep records that reconcile against your asset register.

If you are reviewing a provider or specifying secure destruction services, ask for a sample certificate, ask which DIN 66399 level applies to your SSDs specifically, and ask whether you can witness a destruction run.

Total Shred handles hard drive destruction, IT asset disposal and security document destruction for UK businesses, with serialised certificates and a documented chain of custody on every collection. That is what gives compliance owners peace of mind at audit.

Get a quote or call 0800 298 4009.

 FAQ

Does ISO 27001 require hard drives to be physically destroyed?

No. It requires you to ensure information cannot be recovered from equipment leaving service. Verified erasure is acceptable where it can be reliably achieved and evidenced. Physical destruction becomes the answer when erasure cannot be verified, when drives are unresponsive, or when the sensitive information is too valuable to trust to software.

What shred size does ISO 27001 specify?

None. The sizes quoted in the market come from DIN 66399. H-5 caps particles at 320 mm² for magnetic disks and is the common commercial baseline, with E-4 at 30 mm² typically applied to solid state storage devices.

Is degaussing enough to meet ISO 27001?

For magnetic drives and tape, degaussing is an effective sanitisation method where documented and verified. It does not work on SSDs or any flash-based media, and leaves no visible sign, so most organisations shred afterwards.

Do I need a certificate of destruction for every drive?

You need destruction records that reconcile against your asset register. In practice that means certificates listing individual serial numbers, because only a serialised certificate lets an auditor trace a specific asset from register to destruction.

Should I choose on-site or off-site shredding?

On-site destruction removes transport risk and lets you witness the process. Off-site processing usually achieves finer particle sizes at lower cost and is defensible where chain of custody controls are documented. Total Shred provides both.