Is there a standard media destruction checklist for India?

There is no single statutory checklist, but the pattern is consistent: a written policy naming methods per media type, a per-asset destruction register, verification evidence, trained and authorised operators, chain of custody, authorised e-waste disposal, and a periodic review. This page is that checklist in a form you can hand to an auditor.

How often should the process be reviewed?

At least annually, and after any audit finding, incident, change of machine, change of vendor, or significant change in the media estate. A review triggered by an incident is a good practice to state explicitly in the policy.

Who should own the process?

One named owner in IT or infrastructure, with a compliance or audit owner who samples it, and a custodian who signs the register. Splitting ownership across three teams with nobody accountable is how processes quietly stop happening.

What are the most common findings in Indian audits?

Media in general waste; a batch-register rather than a per-asset register; no verification evidence for the machine; no flash destruction step at all; backup tape not covered; outsourced disposal with no contract or audit rights; and no evidence of recycler documentation.

Can we use this as an audit checklist?

Yes. Print it, use it as a self-assessment before the audit, and hand it to the auditor as the process walkthrough. The field entries are the register columns you should already be capturing.

Data Destruction & Degaussing Compliance Checklist India

1. Policy and governance

#	Check	Evidence
1.1	A written media disposal / sanitisation policy exists	The document, with version and approval date
1.2	The policy names a method for each media class, not just "secure disposal"	Policy clauses per media type
1.3	The policy references a recognised standard (NIST 800-88, DoD, or an NSA listing where required)	Policy clause
1.4	A named owner is accountable for the process	Policy clause, org chart or RACI
1.5	A compliance or audit owner samples the process periodically	Sampling record or internal audit report
1.6	The policy states how often it is reviewed and what triggers an out-of-cycle review	Policy clause
1.7	Data classification determines the required sanitisation level	Classification scheme and policy clause
1.8	Retention periods are defined, so destruction cannot destroy data you must keep	Retention schedule

2. Media coverage — is anything unassigned?

#	Check	Evidence
2.1	Hard disk drives (2.5" and 3.5") are covered	Policy and register
2.2	Server and enterprise drives are covered	Policy and register
2.3	Failed, clicking or non-enumerating drives are explicitly covered	Policy clause and register example
2.4	LTO / DLT / DAT / DDS tapes are covered	Tape inventory and register
2.5	Off-site and vaulted tapes are covered by the same process	Policy clause, off-site contract
2.6	SSDs, M.2 and NVMe modules are covered by a <b>destruction</b> method	Policy and shredder records
2.7	Pen drives, memory cards and removable media are covered	Policy and shredder records
2.8	Smartphones, tablets, handhelds and POS devices are covered	Device return procedure
2.9	SIM cards, credit, debit and ID cards are covered	Policy and shredder records
2.10	Optical media (CD / DVD) is covered	Policy and shredder records
2.11	Returned, buy-back and leased devices are covered by a named process	Device return procedure and contract
2.12	Cloud and SaaS provider disposal assurances are recorded	Contract clauses and register

Check 2.6 is the one most organisations fail. A policy that says "all media is degaussed" is wrong for any modern estate, because a degausser does nothing to flash. If there is no shredder step for SSDs, phones and cards, that is your first finding.

3. Method and verification

#	Check	Evidence
3.1	Magnetic media is degaussed (purged), not merely erased or formatted	Policy and register
3.2	Sanitised media is physically destroyed where policy requires it	Policy and crusher records
3.3	Flash and optical media are physically destroyed, not just wiped	Policy and shredder records
3.4	The degausser reports field strength or cycle status per cycle	Machine model and register entries
3.5	Verification values are recorded in the destruction register	Sampled register rows
3.6	The machine has a current field-strength verification certificate	Certificate with readings
3.7	Verification frequency is defined in policy	Policy clause and AMC schedule
3.8	An inoperable or unverified machine is treated as out of service for record purposes	Policy clause
3.9	Any machine requiring an NSA listing is actually listed	EPL reference on file

4. Process and records

#	Check	Evidence
4.1	Media are identified and matched to the asset register before destruction	Reconciliation record
4.2	A destruction register exists with one row per asset	Sampled register
4.3	The register captures: date, asset tag, serial, media type, capacity, classification	Register column list
4.4	The register captures: machine model and serial, verification value, method	Register column list
4.5	The register captures: operator name and signature, custodian signature	Register column list
4.6	The register is not batched — no "20 drives destroyed" rows	Sampled register
4.7	Exceptions and discrepancies are recorded with reasons	Reconciliation record
4.8	Register retention period is defined and aligned to the longest data retention period	Records management policy
4.9	Media cannot enter general waste — bins are segregated and labelled	Physical inspection evidence
4.10	A destruction queue or job ticket exists so media does not sit indefinitely	Queue record or ticket system
4.11	Sanitised media cannot re-enter the asset register	Asset register status rules

5. People and access

#	Check	Evidence
5.1	Only named, trained operators may use the degausser or shredder	Authorised operator list
5.2	Training records exist, with dates	Training records
5.3	Operators know that a degausser does not affect flash media	Training content
5.4	Batteries are removed from devices before shredding	Procedure and training
5.5	Access to the destruction room is controlled and logged	Access list, key or badge records
5.6	Interlocks are never defeated or bypassed	Procedure, machine condition
5.7	Working area is dry, ventilated and within the machine's environmental limits	Environment log
5.8	Safety procedure for operating the crusher is documented and known	SOP and training

6. Chain of custody and disposal

#	Check	Evidence
6.1	Media are stored in a controlled, locked area until destroyed	Physical control description
6.2	Transport, if any, uses closed, labelled containers with a manifest	Transit record
6.3	Scrap is handed to an authorised e-waste recycler	Recycler authorisation certificate
6.4	Recycler documentation (weighment, receipt) is retained and linked to the batch	Recycler records
6.5	The downstream chain is traceable — the recycler is not an unknown buyer	Recycler due-diligence file
6.6	There is no route by which intact media leaves as second-hand hardware	Policy clause and process walkthrough

7. Suppliers and contracts

#	Check	Evidence
7.1	Equipment is from the manufacturer or an authorised channel partner	Authorisation letter
7.2	Outsourced disposal contracts name the method and the required standard per media type	Contract clause
7.3	Contracts grant you audit and inspection rights over the disposal process	Contract clause
7.4	The register format is specified in the contract, not left to the vendor	Contract annexure
7.5	The vendor's equipment and verification method are evidenced	Vendor due-diligence file
7.6	Chain of custody and insurance during transit are covered	Contract and insurance certificate
7.7	Vendor performance is reviewed against agreed metrics	Review record
7.8	There is no undisclosed subcontracting of destruction	Contract clause

8. Review and evidence

#	Check	Evidence
8.1	The process is reviewed at least annually	Review record
8.2	The review covers the register, the machine verification and the media estate	Review scope document
8.3	Audit findings on media disposal are tracked to closure	Findings log
8.4	The register can be produced for a sampled period on request	Ready-to-produce register
8.5	A witnessed destruction run has been performed at least once	Signed run register
8.6	The machine's current verification certificate is on file and in date	Certificate
8.7	AMC terms, verification schedule and response commitment are documented	AMC contract
8.8	Incidents where a machine was out of service are recorded with the period affected	Incident log

Data Destruction Compliance Checklist for India

1. Policy and governance

2. Media coverage — is anything unassigned?

3. Method and verification

4. Process and records

5. People and access

6. Chain of custody and disposal

7. Suppliers and contracts

8. Review and evidence

Close the gaps

Inventory every medium

Set method per media class

Get verification evidence

Adopt the register

Close the chain

Put it in the audit plan

The frameworks behind this checklist

Frequently asked questions

Need help closing a gap?