FOI 2026/1652

To avoid any misunderstanding, I would like to clarify that my request relates specifically to the **recorded assurance basis relied upon where software-based erasure of storage media is used**, whether undertaken internally or by a third party provider.

The purpose of the request is to distinguish between:

• confirmation that a software erasure process was executed, and • recorded evidence demonstrating that the **final data state of a specific storage device is irrecoverable** following that erasure.

A certificate, log, or record confirming that a wiping process was applied demonstrates that a recognised method was used. What I am seeking to understand is whether your organisation holds any recorded evidence of the **outcome**, namely evidence that the data on a specific storage device is irrecoverable following software-based erasure, rather than confirmation that the erasure process was executed.

With that distinction in mind, please confirm:

1. Whether any certificates, reports, logs, or contractual terms relied upon by the organisation constitute an **explicit outcome-based warranty or guarantee** that the personal data on each specific storage device has been rendered irrecoverable as a final data state following software based erasure, or whether they primarily confirm that a certified erasure process was followed.

2. Beyond reliance on supplier accreditation, recognised standards (including but not limited to ADISA certification, ISO accreditation, HMG IA standards, NCSC guidance), or confirmation that an erasure process was completed, whether the organisation holds **any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice**.

3. Where validation sampling or quality control testing of erased devices is undertaken, whether any **recorded results of such testing** are held by the organisation.

For clarity, this request relates specifically to **recorded outcome evidence demonstrating irrecoverability of data on the individual storage device following software-based erasure**, not documentation confirming that an accredited or certified erasure method was applied.

If no explicit outcome-based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.

1. The results of software-based erasure confirm the execution of the process however does not constitute an explicit warranty or guarantee.
2. Beyond that, NHS Greater Manchester (NHS GM) do not hold separate recorded evidence of independent verification.
3. No, NHS Greater Manchester (NHS GM) do not keep a separate record of testing beyond evidence from third party of erasure or certificate of destruction.