When most people hear the words data destruction, they probably think about an old computer, laptop or hard drive.
But businesses have been storing information electronically for decades - and that means sensitive data may be sitting on far more than today's computers.
Old CDs. DVDs. Floppy disks. Backup tapes. DLT tapes. Microfiche. USB drives. External hard drives. Servers. Smartphones. Even office equipment with internal storage.
The technology may be obsolete. The information may not be.
So, how often should your business schedule electronic data destruction?
The answer isn't necessarily monthly, quarterly or annually. Federal guidance does not establish one universal destruction schedule for every organization. Instead, organizations should establish a media-sanitization and disposal process based on the type and sensitivity of information, the equipment's lifecycle and when the media leaves the organization's control. NIST's current SP 800-88 Rev. 2, Guidelines for Media Sanitization, published in September 2025, specifically recommends establishing an organizational media-sanitization program with appropriate controls for sanitization and disposal.
For businesses, that means data destruction should be a routine part of information and equipment management - not something that happens only when someone finally cleans out the storage room.
Electronic Data Isn't Limited to Computers
One of the biggest misconceptions about data destruction is that it applies only to computers and hard drives.
Electronic information can exist on many types of media, including:
- Hard disk drives and SSDs
- Desktop and laptop computers
- Servers and network equipment
- Smartphones and tablets
- USB and flash drives
- CDs and DVDs
- Floppy disks
- Magnetic backup tapes
- DLT and other legacy tape formats
- External storage devices
- Microfiche and other imaging media
- Printers, copiers and multifunction devices containing storage
- Other removable or legacy media
NIST's media-sanitization guidance recognizes that organizations may need to address different types of storage media and select appropriate sanitization or destruction methods based on the information and the media involved.
That matters because obsolete doesn't mean harmless.
A floppy disk that hasn't been readable in years may still contain employee, customer or financial information. A box of old CDs may contain backups or archived records. A DLT tape may hold years of business data. Microfiche may contain information that was converted from paper records long ago.
If the information is still recoverable, it still deserves consideration when developing a secure destruction policy.
The FTC Specifically Warns About CDs and Electronic Media
This isn't simply a concern for cybersecurity professionals.
The Federal Trade Commission's guidance for businesses states that discarded materials can expose sensitive information and specifically notes that CDs containing personally identifying information can pose a risk if they are not properly disposed of. The FTC recommends information-disposal practices that are reasonable and appropriate to prevent unauthorized access or use of personal information.
The FTC's Disposal Rule goes further for consumer-report information. It says reasonable disposal practices can include destroying or erasing electronic files or media so the information cannot be read or reconstructed.
In other words, secure destruction isn't just about the latest technology.
It also applies to yesterday's technology.
So, How Often Should You Destroy Electronic Media?
There is no federally mandated "every 90 days" or "once a year" rule that applies to every business.
Instead, businesses should identify events that trigger secure destruction.
When equipment is retired
When a computer, server, phone, hard drive or other device is taken out of service, it should enter the organization's secure disposition process.
Don't put it in a closet and plan to deal with it later.
When storage media is no longer needed
This includes more than equipment.
Old backup tapes, CDs, DVDs, floppy disks, DLT tapes, USB drives and other media should be evaluated when the information they contain is no longer required and applicable retention requirements have been satisfied.
During technology upgrades
A technology replacement project is an ideal time to address the old equipment and media.
If your organization is replacing computers, upgrading servers or moving to a new backup system, build data destruction into the project rather than treating it as an afterthought.
During office moves or consolidations
Moving offices has a way of uncovering things that have been sitting untouched for years.
Boxes of old disks. Shelves of backup tapes. Retired computers. CDs labeled with dates nobody recognizes.
Before throwing any of it away, determine whether it contains information that should be securely destroyed.
When storage media leaves your control
This is particularly important when equipment or media is being sold, donated, returned at the end of a lease, transferred to another organization or sent to a recycler.
NIST's current guidance emphasizes sanitization and disposal as part of the media lifecycle, including circumstances in which media is reused or otherwise leaves an organization's control.
What About Media That Can't Be Read Anymore?
"It doesn't work" isn't the same as "the data is gone."
An old computer may not boot. A floppy disk may be difficult to read. A DLT tape may require obsolete equipment to access it. A damaged hard drive may appear useless.
But the information may still exist on the media.
The FTC similarly cautions businesses not to rely simply on deleting information from devices; its cybersecurity guidance recommends appropriate erasure methods for electronic data.
For organizations dealing with sensitive information, physical destruction may be the appropriate solution for certain media rather than relying on the ability - or inability - to access it.
Don't Forget the "Forgotten" Media
One of the biggest challenges for businesses isn't necessarily the equipment they use every day.
It's the equipment and media they've forgotten about.
Consider conducting a periodic inventory of:
Current technology - Computers, servers, phones, tablets and removable drives.
Stored equipment - Retired computers, backup equipment and devices waiting for disposition.
Legacy media - CDs, DVDs, floppy disks, magnetic tapes, DLT tapes, microfiche and other older formats.
Office equipment - Copiers, printers and multifunction devices that may contain storage.
That inventory can help identify media that should be retained, transferred, sanitized, destroyed or recycled.
Build Data Destruction Into Your Business Routine
Rather than asking, "What month should we schedule data destruction?" a better question may be:
"What events should automatically trigger our data-destruction process?"
For many businesses, those triggers could include:
- Equipment reaching the end of its useful life
- Technology upgrades
- Employee equipment turnover
- Office moves
- Server or backup-system replacements
- End of equipment leases
- Records reaching the end of their required retention period
- Media that is no longer needed
- Equipment or media being transferred, donated, sold or recycled
A periodic review - such as quarterly or semiannually - can also help identify forgotten equipment and media before it accumulates.
The appropriate frequency will depend on the organization.
The important thing is to have a documented, repeatable process.
Data Destruction Is More Than Shredding Hard Drives
Secure electronic data destruction isn't simply about taking a stack of old computers to a recycler.
It's about recognizing where information exists, determining when it should be destroyed, using an appropriate destruction or sanitization method, and documenting what happened.
That can include today's SSDs and hard drives - but it can also include yesterday's CDs, floppy disks, DLT tapes, microfiche and other legacy media.
Technology changes.
The responsibility to protect the information stored on it doesn't.
Data Recycling of New England helps businesses, schools, municipalities, healthcare organizations and other organizations manage retired electronics and data-bearing media. From secure data destruction to responsible electronics recycling and reuse, a thoughtful disposition process can help protect sensitive information while keeping obsolete technology out of the waste stream.
If your organization has a box, cabinet or storage room filled with old electronic media, it may be time to find out what's really on it - and how it should be securely destroyed. We shred DLT tape, VHS, CDs and floppy disks alongside hard drives and other media.