Organizational and Technical Requirements for Companies Writing Off Old Computer Equipment

In today’s business environment, where information is often referred to as “the new oil,” writing off old computers is not just an accounting action. It is an important Data Security process. When sensitive customer information is stored on devices, it is essential to ensure guaranteed and irreversible data destruction (Secure Data Destruction) before ceasing the operation of the equipment in Lithuania, in compliance with the General Data Protection Regulation (GDPR) and national security standards.

In this article, we will explain in detail why simply deleting files is not enough, what legal acts regulate this process in Lithuania, and what technical methods ensure that sensitive data does not fall into the hands of malicious actors.

1. Legal Basis: GDPR and the Laws of the Republic of Lithuania

Organizations operating in Lithuania must comply with EU Regulation 2016/679 (GDPR). According to Article 5 of the GDPR, data must be stored in a form that allows the identification of data subjects for no longer than necessary. When computer equipment is written off, the purpose of storage ceases, creating a legal obligation to destroy the data.

Responsibility and Accountability

The organization must prove that the data has been securely destroyed. This means that “emptying the recycle bin” or even formatting the hard drive is not legally considered sufficient actions, as these processes do not remove the actual data but only the references to it in the file system.

The Cyber Security Law of the Republic of Lithuania also requires operators of critical information infrastructure to ensure that no confidential information remains on decommissioned equipment.

2. Why the “Delete” Button is Misleading?

Most users mistakenly believe that when a file is deleted, it disappears. Technically, the operating system simply marks that space on the hard drive as “free” for new records. Until new information is written over it, old data can be recovered in minutes using Data Recovery tools.

Before writing off equipment, it is necessary to perform a process called Sanitization. This includes methods that make data recovery impossible even with laboratory equipment.

3. Technical Data Destruction Methods

Depending on the type of storage media (HDD – magnetic disks or SSD – solid-state drives), different destruction standards are applied.

A. Software Overwriting: This is a process where special software fills all sectors of the disk with random symbols (0s and 1s). The most commonly used standard is the U.S. Department of Defense DoD 5220.22-M or the newer NIST SP 800-88. Advantage: The equipment remains physically intact and can be donated or sold.
B. Degaussing: This method is applied only to HDDs and magnetic tapes. The device is subjected to a very strong magnetic field. Disadvantage: After this procedure, the disk becomes irreparably damaged. This method does not work for SSDs.
C. Physical Destruction: This is the safest way to handle sensitive information. Disks are shredded into small fragments (often down to 2mm or smaller pieces). Companies must provide a Certificate of Destruction.

4. Characteristics of SSDs: The Wear Leveling Challenge

Modern computers use SSDs that operate differently than traditional HDDs. Due to a technology called Wear Leveling, standard software overwriting may not reach all memory cells, where data fragments may remain.

Organizations are recommended to use the Crypto Erase function (if the disk was encrypted) or to use manufacturer-specific Secure Erase commands that erase the charge from all NAND cells simultaneously.

5. The Process: Steps Before Ceasing Operation

Lithuanian organizations are recommended to follow this checklist:

Stage	Action	Importance
1. Inventory	Accurate list of all devices and their storage media being written off.	Traceability and control.
2. Backup	Transfer of necessary information to new infrastructure.	Business continuity.
3. Method Selection	Physical destruction or software overwriting.	Resource management.
4. Execution	Process carried out by the IT department or a certified provider.	Technical assurance.
5. Documentation	Obtaining a certificate confirming destruction.	Legal proof for VDAI.

Conclusions

In Lithuania, when writing off computer equipment with sensitive data, it is mandatory to ensure their irretrievability. This is not just a matter of good practice – it is a legal obligation. An organization that leaves customer data on written-off disks risks not only huge GDPR fines (up to 2-4% of annual turnover) but also irreparable damage to its reputation. Secure data destruction is the last but one of the most important links in the Information Security Management System (ISMS).

Sources and Recommended Literature:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). On the protection of individuals with regard to the processing of personal data.
NIST Special Publication 800-88 Revision 1. Guidelines for Media Sanitization.
The Cyber Security Law of the Republic of Lithuania.
VDAI (State Data Protection Inspectorate). Recommendations on personal data security measures.
Garfinkel, S. L., & Shelat, A. (2003). Remembrance of Data Passed: A Study of Confidential Information on Used Disk Drives. IEEE Security & Privacy.
Diesburg, S. M., & Wang, A. I. (2010). A Survey of Confidential Data Storage and Deletion Methods. ACM Computing Surveys.