GLBA requires financial institutions to securely dispose of customer information so it cannot be read or reconstructed — which means data destruction to a recognized standard, documented with a certificate of destruction and an unbroken chain of custody. The law sets the obligation to protect customer data through the end of its lifecycle; the method and the proof are what turn that obligation into something you can defend in an examination.
For financial services, a retired drive isn’t just old hardware — it’s a container of regulated customer information, and its disposal is squarely inside your compliance program. Here is what GLBA actually expects and how to meet it cleanly.
What GLBA says about disposal
The Gramm-Leach-Bliley Act’s Safeguards Rule, enforced by the FTC, requires financial institutions to develop and maintain safeguards that protect customer information. Those safeguards aren’t limited to systems in active use — they extend to how you retire and dispose of the media that held the data.
The disposal expectation is straightforward in principle: properly dispose of customer information so it can’t be accessed after the equipment leaves your control. Deleting files or reformatting a drive doesn’t clear that bar — the underlying data is recoverable with off-the-shelf tools. Proper disposal means rendering the data unreadable and unrecoverable, and being able to prove it.
GLBA doesn’t hand you a technical recipe. It sets the duty of care and leaves the method to established practice — which is where sanitization standards come in.
NIST 800-88 as the method
The widely accepted way to meet GLBA’s “properly dispose” expectation is NIST SP 800-88 Rev. 1, the U.S. reference for media sanitization. It defines three levels matched to media type and data sensitivity:
- Clear — overwrite user-addressable space to defeat simple recovery.
- Purge — firmware-level sanitize or cryptographic erase that defeats laboratory recovery.
- Destroy — physical destruction (shredding, disintegration) so media can never be read.
For customer financial data leaving your custody, that typically means Purge or Destroy. Where physical destruction is required, media is shredded to under 2mm. The standard’s discipline — method matched to media — is exactly the kind of defensible, documented decision an examiner wants to see. For the deeper dive, see how we handle data destruction.
The audit trail examiners expect
In financial services, doing the destruction is only half the job. The other half is proving it — and the proof is what an FTC inquiry, an SEC or FINRA examination, or an internal auditor will actually ask for.
Two documents carry that weight:
- A certificate of destruction issued per device, tied to the serial number, so each specific asset is accounted for.
- An unbroken chain of custody showing who handled each device from pickup through final disposition.
| Requirement | What it looks like | Why examiners want it |
|---|---|---|
| Secure disposal | NIST 800-88 wipe or physical destruction | Meets “properly dispose” duty |
| Per-serial proof | Certificate of destruction per device | Ties destruction to specific media |
| Chain of custody | Documented custody, pickup to disposition | Shows no gap where data could leak |
| Reporting | Audit-ready records on demand | Answers exams without follow-up |
If a provider can destroy data but can’t produce serial-level evidence, you don’t have a compliant program — you have a liability with a receipt missing.
Chain of custody: closing the gap
The most exploitable weakness in disposal isn’t the destruction itself — it’s the handoffs around it. Every point where a drive changes hands without a record is a gap an examiner will flag and an incident could exploit.
A defensible chain of custody logs each asset by serial number at pickup, tracks it through transport and processing, and closes the loop with the certificate of destruction. Whether the work happens onsite at your facility or offsite at a secure processing site, the custody record has to be continuous. That continuity is what lets you stand in front of a regulator and show, device by device, that customer data was destroyed — not just that a truck came and took some equipment away.
Your vendor is part of your compliance
GLBA’s expectations follow the data, which means the third party you hand retired equipment to is inside your compliance perimeter. Choosing a provider with recognized certifications — R2v3, ISO 14001, ISO 9001, ISO 45001 — and a documented, serial-level process isn’t a nice-to-have; it’s how you demonstrate due diligence in vendor selection.
CTS works with financial services organizations on exactly this: NIST 800-88-aligned data destruction, media shredded to under 2mm where physical destruction is required, a certificate of destruction per serial, and continuous chain of custody — onsite or offsite, with national coverage from our Norcross, GA headquarters.
Getting examiner-ready
GLBA data destruction comes down to three things: destroy customer information to a recognized standard, prove it at the serial level, and keep an unbroken chain of custody from pickup to certificate. Get those right and disposal stops being an audit risk and becomes evidence of a well-run program.
If you’re a financial institution planning a hardware refresh, a branch consolidation, or a datacenter decommission, talk to our team about building a defensible, examiner-ready disposal process — or start with our financial services overview to see how the pieces fit your regulatory picture.