Certificate of data destruction: what it should include (template)

When to require a certificate of data destruction#

A certificate of data destruction is a signed attestation from the party that held your data, stating which copies were destroyed, how, when and by whom. Require one whenever data you control leaves a recipient's hands for good, because a contract clause that says delete is only as useful as the evidence that deletion happened.

• 1A license term ends and the agreement requires return or destruction.
• 2A license is terminated early for breach or for convenience.
• 3A prospective buyer evaluated a sample and the deal did not proceed.
• 4An encrypted drive used for delivery is returned or retired.
• 5A preparation vendor or contractor finishes work on your records.
• 6A data room used during a transaction is closed.

Fields every certificate should include#

The fields that matter most are the ones that pin down scope: exactly which dataset, which copies and which derived materials. Generic certificates written for retired laptops and hard drives often omit these, because IT asset disposition is about devices, while a data license is about information that may sit in many places at once.

Template wording you can adapt#

The template below is a starting point; your counsel should adapt the wording to the agreement it supports. Square brackets mark the parts to complete, and every bracket should be filled or marked none before signature.

• 1Certificate of data destruction, reference [certificate ID], issued [date].
• 2[Recipient legal name] certifies to [licensor legal name] that, under [agreement name and date], clause [clause reference], it has destroyed the data described below.
• 3Datasets covered: [dataset ID, version and delivery date for each].
• 4Copies destroyed: [each storage location, system or device], destroyed on [date] by [method] in accordance with [standard or internal policy].
• 5Derived materials destroyed: [subsets, transformed versions, annotations, embeddings, indexes], destroyed on [date] by [method].
• 6Backups: [purged on date] or [held in backups that expire no later than date, with no restoration permitted before expiry].
• 7Retained under exception: [none] or [description, legal basis and planned destruction date].
• 8Performed by [name, role]; verified by [name, role].
• 9Signed by [name and title] on [date] on behalf of [recipient legal name].

Describing the destruction method accurately#

The destruction method should match where each copy lived, so one certificate often lists several methods. A file deleted from a cloud bucket, a laptop wiped by IT and an encrypted drive shredded by a disposal vendor are different events, and each deserves its own line.

Ask the recipient to name the standard or internal policy it followed, such as its media sanitization policy or a recognized government or industry sanitization standard, rather than writing securely deleted with no reference.

What deletion cannot reach once a model is trained#

Deleting training files does not remove what a model learned from them. Once records have been used to train a model under the license, the model's weights carry statistical patterns rather than retrievable records, and deleting the dataset leaves those weights unchanged.

That is why the license, not the certificate, has to settle what happens to models trained during the term. Some agreements let the licensee keep models trained before expiry; others restrict their use or require retraining. The certificate should then state the position plainly, for example that training copies were destroyed and that models trained during the term are retained as permitted by a named clause.

Be wary of any certificate that implies more than deletion can deliver. A clear statement of what was destroyed and what remains is more useful to your counsel than a broad promise that all traces are gone.

Backups and cloud storage need their own line#

Backups need their own line on the certificate because most cloud services cannot remove one customer's files from a backup set on request. Data typically ages out on the provider's published schedule instead.

Providers do publish these schedules. Microsoft's Trust Center says that after a cloud subscription's retention period ends, Microsoft deletes customer data, including cached and backup copies, within 90 days for in-scope services. Greenhouse says that when it deletes a departing organization's data from production, remnants persist until backups expire.

Ask the recipient to name the services involved, give the date by which backups will have expired, and confirm that nothing will be restored from them before then.

Illustrative: closing out an evaluation that did not proceed#

Illustrative: a fictional precision parts manufacturer shared a de-identified sample of nonconformance reports and corrective action records with a prospective licensee for evaluation. After review, the prospective licensee decided the records did not fit its current project, and the evaluation agreement required destruction.

The manufacturer's general counsel asked for a certificate using the fields above. The first draft listed only the storage bucket that received the sample. On follow-up, the recipient added analysts' working copies, a converted version used for testing and a search index built over the text, and listed its backups with their expiry date.

The final certificate went into the manufacturer's privacy record with the evaluation agreement and the delivery log, so the chain of custody for the sample ends with a signed, specific statement.

How SourceX handles end-of-term destruction#

SourceX treats return and destruction terms as part of the Approval step of the SourceX five-step transaction, so the certificate requirement is written into the license before Delivery takes place. The SourceX Evidence Packet records permitted use and release authorization, which gives any certificate a fixed reference for what was delivered and to whom.

When a term ends or an evaluation closes, the destruction certificate is checked against the delivery record. Gaps, such as a derived copy the certificate does not mention, are raised with the recipient before the file is closed.