DATA SANITIZATION — GUIDE
A complete guide to data destruction in Indonesia
Deleting and formatting do not destroy data. This guide covers what IT, security, and compliance teams usually ask before retiring hard drives, SSDs, or tapes: the right method for each media type, the rules that apply in Indonesia, the evidence auditors ask for, and what drives the cost.
Every year organizations in Indonesia retire thousands of hard drives from laptops, servers, ATMs, hospital imaging systems, and network devices. Most are stored in a warehouse, sold second-hand, or handed to a vendor with no record of what happened to the data on them. That is where data leaks most often go unnoticed: not while systems are running, but after the device is no longer in use.
Proper data destruction has two conditions. First, the data must be unrecoverable, even with laboratory forensic tools. Second, there must be evidence an auditor can see: which media, which serial number, which method, when, and witnessed by whom. Many organizations meet the first condition and fail the second.
This guide is written by DTI's Data Sanitization team and references NIST SP 800-88 Rev. 2, IEEE 2883, ISO/IEC 27001:2022, and the relevant Indonesian regulations. DTI provides data destruction services and destruction machines across Indonesia.
Four mistakes we see most often
Treating a format as destruction
Delete, format, and factory reset only remove pointers to the data. The data itself stays on the platter or memory cells and can be recovered with off-the-shelf recovery software.
Using one method for every medium
Degaussing works very well on magnetic hard drives and tapes, but has no effect on SSDs, USB drives, and memory cards because they do not store data magnetically. SSDs need verified crypto-erase or physical destruction.
No inventory and no evidence
Retired drives pile up without a list of serial numbers. When an ISO 27001 auditor, OJK examiner, or accreditation surveyor asks where the media went, there is nothing to show.
Handing media over without a chain of custody
Media moved out of the building without seals, a manifest, or witnesses can go missing in transit. A single lost drive is enough to become a personal-data incident.
The right method for every media type
Hard drives (HDD) and magnetic tape: degaussing
A degausser applies a strong magnetic field that destroys the magnetic patterns on the platter or tape, erasing the data and leaving the drive unusable. Fast at volume. For higher assurance, follow with physical destruction.
SSDs, USB drives, and memory cards: crypto-erase or physical destruction
On SSDs with built-in encryption, a verified cryptographic erase counts as Purge under NIST SP 800-88. Where verification is not possible or the data is highly sensitive, the SSD is shredded to small particle size with an SSD-rated shredder.
Highly sensitive data: physical destruction (Destroy)
A shredder or destroyer breaks the drive into particles so no part of the media can be read. This is the highest level and is often chosen for customer data, medical records, and classified documents.
Devices staying in use: verified overwrite (Clear)
For a laptop reassigned to another employee inside the organization, a verified overwrite may be enough. It is not used for devices leaving the organization.
Every method ends with evidence
Whatever the method, the end result is a destruction certificate (Berita Acara Pemusnahan) per serial number: media type, method, date, location, witnesses, and signatures. That is the document auditors look for.
DTI's Data Sanitization services and machines are used by banks and companies in Indonesia, with support across the country.
Steps to data destruction you can defend
Inventory
Record every medium to be destroyed: type, capacity, serial number, source device, and the sensitivity of its data.
Choose the method
Set the method per media type and sensitivity: degaussing for magnetic media, crypto-erase or physical destruction for SSDs, Destroy for the most sensitive data.
Witnessed execution
Destruction happens at your site or at the destruction facility, with witnesses from your organization and media kept in sealed containers whenever it has to be moved.
Documentation
Issue a destruction certificate per serial number and file it with your retention policy as evidence for the next audit.
Frequently asked questions about data destruction
Do Indonesian regulations require hard drives to be physically destroyed?
Not literally. UU PDP Articles 43 and 44 require personal data to be erased and destroyed once the retention period or processing purpose ends, so that it cannot be recovered. Physical destruction is one way to meet that, and the strongest. Degaussing (for magnetic media) and verified crypto-erase (for SSDs) are also accepted depending on data sensitivity.
Can an SSD be degaussed?
No. SSDs and flash memory store data electronically, not magnetically, so a degausser does not erase them. SSDs need a verified crypto-erase or destruction with an SSD-rated shredder.
What evidence do auditors ask for?
Usually a destruction certificate listing each medium's serial number, the method used, date, location, witnesses, and signatures, plus a retention policy that defines when data must be destroyed. For ISO/IEC 27001:2022 this relates to Annex A controls 7.10, 7.14, and 8.10.
Should we buy a machine or use a service?
If your volume of media is large and recurring, such as a bank with hundreds of branches or a data center, owning a machine can be more economical and keeps the process in your hands. If destruction happens only a few times a year, an on-site service is usually cheaper because there is no machine to buy, operate, and maintain.
What determines the cost of data destruction?
The number and type of media (HDD, SSD, tape), the chosen method, where it is performed (your site or a destruction facility), witnessing and documentation needs, and scheduling. For machine purchases, the factors are throughput per hour, supported media types, and certification level.
Does DTI work outside Jakarta?
Yes. DTI provides data destruction services and destruction machines across Indonesia. Tell us your location and media volume, and our team will put the plan together.
Related topics
DATA SANITIZATION — GUIDE
Need a destruction plan for your media?
Send us an outline of the type and number of media you are retiring. The DTI team will recommend a method per medium, service or machine options, and a sample evidence pack, at no cost.
