Updated November 2026 · Southern New Hampshire
Certified data destruction New Hampshire businesses can defend in an audit
This is a plain guide to certified data destruction New Hampshire businesses can rely on: what the word “certified” usually means, what NIST SP 800-88 Rev. 2 says a good record holds, and why serial numbers matter more than logos. It also shows exactly how we count, destroy and document drives at our Tewksbury office.
Media quoted per item before we start. Certificate of Destruction on every job.
- Per item media quotes
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
For most New Hampshire businesses, “certified data destruction” should mean one thing you can hold: a certificate that lists who destroyed which devices, by serial number, on what date and by what method, in line with NIST SP 800-88 Rev. 2, which replaced Rev. 1 on September 26, 2025. New Hampshire Document Shredding physically destroys drives, phones, tapes and other media at 1215 Main Street, Unit 115, Tewksbury, MA, quotes every item before it starts and issues a Certificate of Destruction on every job. We do not hold a trade association certification, so if a contract requires one, check that before you book. Our main page on hard drive destruction covers the full list of media we take.
Certified data destruction New Hampshire offices can document
The phrase sounds official, and that is the problem. No federal agency and no New Hampshire statute issues a license called “certified data destruction.” When a vendor uses it, they can mean several different things, and only some of them help you if an auditor, an insurer or a client asks what happened to an old server.
Most callers who ask for it want the paper trail: a document in the file for a stack of retired laptops. That is a different thing from a company holding a membership badge.
A certificate of the job
A signed record of what was destroyed, when, how and by whom. This is the part every business needs, and the part you should judge most closely.
A certification of the vendor
A trade association or auditor has reviewed the company’s operations. Some contracts require one. Many small office purges never do.
A software erasure report
Wiping tools print a log when a working drive finishes an overwrite or a secure erase. Useful for reuse, but it says nothing about a drive that would not spin up.
Your own sign-off
NIST calls it validation: someone in your organization reviews the record and accepts it. It turns a vendor’s paper into your company’s decision.
So start with a question for yourself before you call anyone. Does your contract, your cyber insurance policy or your client agreement name a specific certification? If it does, that decides the vendor. If it only says “certified destruction” or “certificate of destruction,” what you need is a complete, specific record, and the rest of this post is about getting one.
What NIST SP 800-88 Rev. 2 changed
NIST Special Publication 800-88, Guidelines for Media Sanitization, is the reference most IT policies point to. For more than a decade everyone quoted Revision 1, from December 2014. NIST withdrew Revision 1 on September 26, 2025 and superseded it with Revision 2, published the same month.
If your written policy still says “per NIST 800-88 Rev. 1,” update the citation. The three methods carry over, but Revision 2 is written for people setting up a sanitization program, with more weight on checking results and writing them down.
The three methods in plain words
Clear overwrites every location a user can reach, through the device’s normal interface. NIST says it protects against simple, non-invasive recovery. Purge uses physical or logical techniques so that recovery is infeasible even with advanced laboratory methods. Cryptographic erase on a self-encrypting drive is the main example.
Destroy also makes recovery infeasible in a lab, and the media can never store data again. That is the category our service sits in.
Two cautions worth knowing
Revision 2 warns that as storage gets denser and harder, some destructive techniques leave readable fragments. It says pulverize and shred techniques for storage media should be avoided for anything but the lowest security categories of data.
It also notes that bending, cutting or drilling a hole may only partly damage a device. If your data is highly sensitive, your own policy should name the method, and you should ask any vendor plainly whether their process meets it.
NIST also says the simplest and most cost effective choice for media that will not be reused is often to destroy it. For a closet of dead laptops, that is the usual answer. For a working PC going to a nonprofit, a verified purge is the better tool. Our guide to hard drive disposal in New Hampshire walks through that choice for households and small offices.
What a certificate of destruction should list
Section 4.6 of Revision 2 says a certificate of sanitization should be completed for each storage device, on paper or electronically. It then lists the minimum details a completed record should hold. Appendix C adds a sample form with blocks for the person doing the work, the media, the method and where the media ended up.
You do not have to copy the NIST form. But it makes a good checklist for judging any vendor’s paperwork, ours included. Here is how the fields map to a drop-off job.
| NIST field (Sec. 4.6) | What it records | Who supplies it on a drop-off job |
|---|---|---|
| Manufacturer and model | Make and model of each drive or device | You, on the list you tape to the bag |
| Serial number | The unique number on the drive’s own label | You list it. We check it against the device at the counter |
| Property or asset number | Your internal tag, if you use one | You, on the same list |
| Media type and source | Hard drive, SSD, phone, tape, and the computer or user it came from | You for the source, both of us for the type count |
| Sanitization method | Clear, purge or destroy | Destroy, by physical destruction at our office |
| Technique and tool | How it was done and with what equipment | Ask us when you book, and note our answer in your record |
| Verification | How someone confirmed the job finished | Count checked against your list before and after |
| Who did it, date, signature | Name, title, date, location, contact, signature | Our staff sign the Certificate of Destruction |
A vendor can only certify what it was told. If you hand over a bag marked “old drives” with no list, the best possible certificate says “one bag of old drives.” That is a receipt, not a record.
Our post on the certificate of destruction explains the document for paper jobs. For media, the serial number field does most of the work, which is why it gets its own section.
Serial numbers: the field that carries the weight
An asset list says you owned a laptop. A certificate with a matching drive serial number says that specific drive no longer exists. Put the two side by side and an auditor has nothing left to ask.
One tip from the counter: use the serial number printed on the drive, not the one on the laptop case. After a repair or an upgrade, the case number tells you nothing about which drive was inside. Pull the drive, read its label and write the number down, or photograph the label with your phone.
Then print the list, one line per device, and tape it to the outside of the bag. If you want serial numbers on your certificate, ask for them to be listed when you book. We check the list against the devices before anything is destroyed, so a missing or extra drive is caught while you are still standing there.
- One line per device: type, make, model, drive serial, your asset tag if any.
- Keep phones powered off, with the SIM and any memory card you plan to keep removed.
- Put USB sticks and small M.2 drives in a labeled envelope so nothing slips out.
- Keep a copy of the list. Staple the certificate to it when you get home.
A bigger retirement, such as a whole office refresh, is easier in batches by department. Our guide to office cleanout shredding covers the paper side of the same project, and the media rides along on its own list.
The certified data destruction New Hampshire customers get in Tewksbury
Every media job runs through one place: our office at 1215 Main Street, Unit 115, on Route 38 near the I-495 interchange, about 15 minutes south of the Salem and Pelham line by I-93 or Route 38. We do not bring equipment to your building and we do not destroy anything at your address. Your devices come to us, and that is where they end.
- Count and quoteCall (978) 636-0301 or book online with a count by type, such as nine laptop drives, two server drives and three phones. Media is quoted per item, so you have the price before you load the car.
- Bag and list at your officeKeep media in its own bag or box, apart from any paper. Tape your printed serial list to the outside and write the total count on it.
- Bring it in on a weekdayWe are open Monday to Friday, 10 a.m. to 5 p.m. Park out front. Offices booking a paper pickup can ask about media when they book.
- Check the count at the counterWe count the devices with you and check them against your list. Anything that does not match gets settled before you leave.
- Physical destructionThe media is physically destroyed at our office so it cannot be read or used again. It is never mixed into a paper load.
- Certificate of DestructionYou receive a signed certificate for the job. File it with your asset list and your list of serials.
Paper can come on the same trip. Our drop-off shredding counter takes walk-ins at 99 cents per pound, plus $34.90 in per-job fees, and the drives go on their own line of the quote. We publish no per-drive price, because a laptop drive and a backup tape do not take the same handling. Paper prices are on our shredding rates page.
For the custody side, meaning who held your devices and when, our post on chain of custody shredding lists the handoffs to write down.
Vetting a vendor: what the FTC suggests
The FTC’s Disposal Rule applies to businesses that use consumer report information, such as landlords, employers, lenders and auto dealers. Its business guidance says reasonable disposal includes policies to destroy or erase electronic files or media so the information cannot be read or reconstructed, and due diligence before you hire a destruction contractor.
The FTC gives examples of what that diligence can look like. It is a menu, not a required checklist, and it is useful for any New Hampshire business picking a vendor.
What the FTC lists
- Review an independent audit of the company’s operations or its compliance with the Rule.
- Get information about the company from several references.
- Require that the company be certified by a recognized trade association.
- Review and evaluate the company’s information security policies or procedures.
Our straight answer
We do not hold a trade association certification, and we will not pretend otherwise. If your contract, insurer or client requires one, choose a vendor that has it.
What we can offer is a process you can see. You can watch your devices counted at the counter, ask us how they are destroyed, review the certificate format before you book, and sign a Business Associate Agreement if you are a HIPAA covered entity.
Our list of questions to ask a shredding company works for media vendors too: where the destruction happens, who touches the devices, what the certificate lists and how serial numbers are handled.
Which rules ask for proof of destruction
New Hampshire has no statute that tells a business how to destroy a hard drive. The duties come from federal rules for certain kinds of data, from your contracts, and from what happens if a readable drive goes missing.
HIPAA Security Rule, for electronic PHI
45 CFR 164.310(d)(2)(i) requires covered entities to “implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.” Paragraph (d)(2)(ii) requires removing ePHI before media is reused. This section covers electronic media only. Paper charts fall under the Privacy Rule safeguards at 164.530(c), covered in our guide to HIPAA shredding requirements.
FTC Disposal Rule, 16 CFR Part 682
Covers consumer report information in any form, including electronic media, as described above.
IRS Publication 4557, for tax preparers
The IRS guide Safeguarding Taxpayer Data (Rev. 6-2024) tells tax professionals to physically destroy hard drives, tapes, USBs, CDs, tablets or phones. Firms often bring retired machines in after the season along with paper, as our page on shredding for accountants describes.
New Hampshire breach notice, RSA 359-C:20
A business that owns or licenses computerized data with personal information must assess a security breach promptly and, where misuse has occurred or is reasonably likely, give notice. A readable drive that leaves your control is how many of these cases begin. Our post on the NH data breach law explains the notice rules.
How long to keep the certificate
Keep it at least as long as the records it relates to could come up in an audit, a claim or a dispute.
For a HIPAA covered entity, 45 CFR 164.530(j)(2) says required documentation must be kept “for six years from the date of its creation or the date when it last was in effect, whichever is later.” Many practices file disposal certificates on the same six-year clock as their policies. For tax records, the IRS periods run from 3 to 7 years depending on the situation, and longer if a return was never filed.
Scan each certificate with its serial list into one folder by year, and keep the paper copy with your IT asset records.
Frequently asked questions
Is New Hampshire Document Shredding a certified data destruction company?
We issue a Certificate of Destruction on every job, and for media it can list your serial numbers when you bring a list and ask. We do not hold a trade association certification. If your contract, insurer or client requires a specific certification, check that requirement first and choose a vendor that meets it. If it asks for a certificate of destruction, ours covers that.
What should a certificate of data destruction include?
NIST SP 800-88 Rev. 2 lists the minimum: manufacturer, model, serial number, any asset number, media type and source, the method (clear, purge or destroy), the technique and tool, how the result was verified, and the name, title, date, location, contact details and signature of the people involved. Use it as a checklist for any vendor’s paperwork.
Will my drive serial numbers be on the certificate?
They can be. Ask for serial numbers to be listed when you book, and tape a printed list to the bag with one line per device. We check the list against the devices at our Tewksbury counter before anything is destroyed. Use the serial on the drive’s own label, not the laptop case, so the record identifies the actual storage device.
Is NIST SP 800-88 Rev. 1 still current?
No. NIST withdrew Revision 1 on September 26, 2025 and superseded it with Revision 2, published in September 2025. The three methods, clear, purge and destroy, carry over. Revision 2 puts more weight on running a sanitization program, verifying results and documenting each device. Update any policy that still cites Revision 1.
Do you destroy drives at our office?
No. All media is destroyed at our office at 1215 Main Street, Unit 115, Tewksbury, MA, about 15 minutes south of the New Hampshire line. Bring drives in on a weekday between 10 a.m. and 5 p.m., or ask about media when you book a paper pickup. Nothing is destroyed at your address, and we have no drop box in New Hampshire.
How much does certified data destruction cost?
Drives, phones, tapes and other media are quoted per item, because they take different handling. Call (978) 636-0301 with a count by type and you will have the price before you drive down. Paper on the same trip costs 99 cents per pound at drop-off, plus $34.90 in per-job fees that include the Certificate of Destruction paperwork.
Does HIPAA require a certificate of destruction for old computers?
HIPAA does not name a certificate. 45 CFR 164.310(d)(2)(i) requires policies and procedures for the final disposition of electronic PHI and the media it sits on, and 164.530(j) requires required documentation to be kept six years. A certificate matched to your device list is the plainest evidence that your disposal policy was followed.
Sources
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025) (checked November 2026)
- NIST SP 800-88 Rev. 1, withdrawn September 26, 2025 (checked November 2026)
- GovInfo: 45 CFR 164.310, HIPAA physical safeguards, paragraph (d) device and media controls (checked November 2026)
- FTC: Disposing of Consumer Report Information? Rule Tells How (checked November 2026)
- IRS: How long should I keep records (checked November 2026)
- NH General Court: RSA 359-C:20, notification of security breach required (checked November 2026)
Retire your drives with a record that holds up
List your serials, call for a per-item quote and bring the bag to Tewksbury on any weekday. You leave with a signed Certificate of Destruction that matches your list, ready for the asset file.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred paper: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound. Media quoted per item.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.