What is a certificate of data destruction?
Most NDAs, service contracts and data processing agreements say that when the work ends, the recipient must return or destroy the other party's information and confirm it in writing. A certificate of data destruction is that confirmation. It gives the disclosing party a clear record of what was covered, where it was held, what was done with it and when — evidence that matters if the information turns up later, or if a regulator or customer asks how personal data was handled.
This certificate identifies the agreement or project, the information covered and every place it was held, whether it included personal data, whether it was destroyed, returned, or returned and then destroyed, the destruction methods and who carried them out, whether subcontractors held copies and confirmed deletion, any copies legally kept, and how backups are handled. The disclosing party signs to acknowledge receipt without giving up any rights.
- Best for
- End of an NDA, contract, project or data processing arrangement
- Signed by
- The certifying party, then the disclosing party acknowledges receipt
- Options
- Destroyed, returned, or returned and then destroyed
- Length
- About 2 pages
When to Use a certificate of data destruction
- Confirming return or destruction at the end of a mutual or one-way NDA
- A contractor or agency certifying deletion of client files when a project ends
- A service provider confirming deletion of personal data when a contract ends
- A marketing agency confirming it deleted a client's customer lists after a campaign
- Closing out due diligence after an acquisition or investment does not go ahead
What You Fill In
16 blanks, then the name and email of each person who signs: certifying party, disclosing party.
1 The parties
- Date of the certificate*
- Certifying party (company or person)*
- Certifying party address
- Disclosing party (company or person)*
2 The information
- Agreement or project this relates to*
- Information covered*
- Did it include personal data?* No · Yes
- Where it was held*
3 What was done
- What was done* destroyed · returned · returned and then destroyed
- How it was returned
- How it was destroyed
- Completed on*
- Carried out by
- Did subcontractors or service providers hold it?* No · Yes
4 Copies kept
- Copies kept
- Backups overwritten within (days)
5 Who signs
- Certifying party signature and date, job title · The party that held the information and certifies it has been returned or destroyed.
- Disclosing party signature and date, job title · The party the information belongs to. Signs to acknowledge receipt of the certificate.
What the certificate of data destruction Covers
- Information covered
- What was done
- Others who held the Information
- Copies kept
- Confirmation
- Acknowledgement of receipt
Using the certificate of data destruction, step by step
1 Identify the agreement and the information
Name the NDA, contract or project the information was shared under, and describe the information broadly enough to include notes and copies. Say whether it included personal data — if so, a data protection paragraph is added.
2 List where it was held
Cloud folders, email accounts, laptops, phones, paper files, and anywhere else. A specific list is more convincing than "all our systems", and makes it easier to check nothing was missed.
3 Record what was done
Choose destroyed, returned, or returned and then destroyed. Describe the destruction method for each kind of record and the date it was finished. Name who did it — including an outside shredding or disposal company and its own certificate number.
4 Deal with copies kept and backups
List anything kept because the law or the agreement allows it, which stays confidential. If automatic backups cannot be deleted one by one, say when they are overwritten. Then sign and send to the disclosing party to acknowledge.
Tips Before You Send It
- Check the agreement's return-or-destroy clause first — it may set a deadline, a required method or who must sign.
- Ask subcontractors and service providers for their own written confirmations before you certify, and keep them.
- Only certify what you have checked. The signer confirms they made reasonable enquiries and that the certificate is true to the best of their knowledge.
- Keep the signed certificate with the original agreement in Files.
Sign It Online In Minutes
- Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
- Name who signs. Tick “This is me” for your own part. VergeHR builds the PDF with every signature, date box on the right line, and you can check or move anything before sending.
- Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in Files and emailed to everyone.
Certificate of data destruction: frequently asked questions
Can we keep some copies after certifying destruction?
Yes, where the law or the agreement allows — for example, records you must keep for tax purposes. List them in the certificate. They remain subject to the confidentiality obligations and are destroyed when the reason for keeping them ends.
What about backups?
If copies sit in automatic backups that cannot practically be deleted one by one, say when those backups are overwritten. Until then they are not accessed and stay confidential. Leave the field empty if no backup copies remain.
Why does the disclosing party sign?
To acknowledge that it received the certificate. The acknowledgement says expressly that it does not waive any rights if a statement in the certificate later turns out to be incorrect.
Is an electronically signed certificate acceptable?
Electronic signatures are generally valid for business documents like this in the US (ESIGN Act and UETA), the UK, the EU (eIDAS) and Canada. VergeHR's audit trail and Certificate of Completion record who signed and when.