Banks, lenders, credit companies, investment businesses, insurance companies and other financial institutions handle highly sensitive customer information every day.
Names, addresses, account information, financial records, credit information and other customer data can remain on laptops, desktops, servers, hard drives, SSDs, backup media and retired IT equipment long after the equipment is no longer being used.
That creates an important question:
What happens to customer information when a financial institution retires or disposes of an IT asset?
This is where GLBA compliance, secure data disposal and data erasure software come together.
The Gramm-Leach-Bliley Act (GLBA) requires covered financial institutions to protect sensitive customer information. The FTC’s Safeguards Rule requires financial institutions under FTC jurisdiction to maintain measures that protect customer information and address the security of information handled by service providers.
But there is an important point that many articles get wrong:
GLBA does not require a specific “GLBA-certified data erasure software.”
Instead organizations need appropriate policies, safeguards and processes for protecting and securely disposing of customer information.
What Is GLBA Compliance?
The Gramm-Leach-Bliley Act, commonly called GLBA, is a U.S. federal law covering financial institutions and the protection of consumers’ personal financial information.
The FTC explains that GLBA requires financial institutions to safeguard sensitive customer information and maintain appropriate information-security practices.
GLBA-related requirements can involve:
- Privacy practices
- Information security
- Customer information protection
- Risk management
- Vendor oversight
- Secure disposal
- Administrative, technical and physical safeguards
For IT departments, this means security should continue through the entire data lifecycle, including when devices and storage media reach the end of their useful life.
Does GLBA Require Secure Data Disposal?
Yes, secure disposal is an important part of the GLBA security framework.
The FTC’s current Safeguards Rule guidance specifically lists secure disposal of customer information as one of the security measures covered organizations need to address. The FTC says covered information should generally be securely disposed of no later than two years after its most recent use, unless there is a legitimate business or legal reason to retain it or targeted disposal is not feasible because of how the information is maintained.
This creates a practical requirement for financial institutions:
Do not simply retire the computer. Protect the information stored on it.
That includes data stored on:
- HDDs
- SSDs
- NVMe drives
- Servers
- USB drives
- External drives
- Backup media
- NAS and SAN systems
- Retired laptops and desktops
What Is the GLBA Disposal Rule?
The FTC Disposal Rule applies to businesses and individuals that maintain or possess consumer reports and related information for business purposes.
The rule requires reasonable measures to protect against unauthorized access to or use of information during disposal.
The FTC gives examples such as:
- Burning
- Pulverizing
- Shredding paper records
- Destroying electronic media
- Erasing electronic files or media so information cannot be read or reconstructed
- Using appropriate document destruction contractors
The rule is deliberately flexible. The appropriate method depends on factors such as the sensitivity of the information, available technology and the circumstances of disposal.
Therefore, GLBA data disposal is not simply a “delete files” task.
GLBA Data Disposal vs Data Erasure
These terms are related but not identical.
Data disposal is the broader process of securely handling information when it is no longer required.
Data erasure is one technical method for removing information from electronic storage.
Media sanitization is a broader technical concept used to make access to data on storage media infeasible for a defined level of effort.
NIST’s current SP 800-88 Rev. 2 defines media sanitization in this way and provides guidance for establishing a media sanitization program based on information sensitivity.
For financial institutions, a good process should therefore connect:
Data retention → Asset identification → Sanitization → Verification → Documentation → Final disposition
Does GLBA Require Data Erasure Software?
No.
There is no single software product that GLBA requires every financial institution to use.
Instead, software can help an organization implement and document its data sanitization procedures.
A strong GLBA data erasure software solution should help answer questions such as:
- Which device was sanitized?
- What storage media did it contain?
- Which method was used?
- When was it processed?
- Who performed the operation?
- Was the result verified?
- What happened to the asset afterward?
This level of documentation becomes particularly valuable when an organization manages hundreds or thousands of devices.
What Should Financial Data Destruction Software Provide?
When evaluating financial data destruction software, do not select a product simply because its marketing page says “GLBA compliant.”
Look at the actual capabilities.
1. Asset Identification
The software should capture information such as:
- Asset ID
- Serial number
- Manufacturer
- Model
- Capacity
- Storage technology
This connects the sanitization result to the actual physical asset.
2. Multiple Storage Technologies
Financial institutions rarely operate one type of storage.
A useful platform should support appropriate workflows for:
- HDD
- SATA SSD
- NVMe
- USB
- SD cards
- External drives
- RAID
- NAS
- SAN
- Enterprise storage
3. Appropriate Sanitization Methods
The software should support methods appropriate to the media and organizational requirements.
NIST SP 800-88 Rev. 2, published in September 2025, is now the current NIST media-sanitization guidance and supersedes Rev. 1.
The revised guidance emphasizes establishing an organizational media-sanitization program rather than treating wiping as an isolated technical activity.
4. Verification
A financial institution should not rely only on a “completed” message.
Data erasure verification helps establish that the selected sanitization process produced the expected result.
5. Audit Trails and Reports
A professional platform should provide useful records that can be retained for internal review and compliance purposes.
Typical information may include:
- Device details
- Sanitization method
- Date and time
- Operator
- Verification status
- Process information
- Final disposition
This creates an evidence trail rather than a simple claim that the drive was wiped.
HDD vs SSD: Why Financial Institutions Need the Right Method
Financial institutions often have a mixture of older HDD-based systems and newer SSD/NVMe devices.
HDD Data Sanitization
Hard disk drives use magnetic storage. Depending on the organization’s requirements and intended asset disposition, an appropriate sanitization or destruction method can be selected.
SSD and NVMe Data Sanitization
SSDs and NVMe drives use flash memory and controllers. They should not automatically be treated like traditional HDDs.
The correct approach depends on the media, device capabilities, information sensitivity and selected sanitization method.
This is why financial data erasure software should support media-aware sanitization instead of applying one generic process to every drive.
Why NIST SP 800-88 Rev. 2 Matters
NIST SP 800-88 Rev. 2 is not a GLBA regulation.
That distinction is important.
GLBA = legal and regulatory framework
NIST SP 800-88 Rev. 2 = technical media-sanitization guidance
NIST says its current guidance helps organizations establish a media-sanitization program with appropriate techniques and controls based on the sensitivity of information.
The 2025 revision also updated the treatment of sanitization methods and places greater emphasis on organizational programs and approved standards, including references to IEEE 2883 and other applicable specifications.
Financial institutions can therefore use NIST as a technical reference when developing or improving their media-sanitization processes, but they should not describe NIST as a mandatory GLBA requirement unless another applicable policy or contract makes it so.
What About Third-Party ITAD Vendors?
Many banks and financial companies use external vendors for:
- Laptop retirement
- Server disposal
- Hard drive destruction
- IT asset resale
- Recycling
- Data center decommissioning
This creates another important issue.
The financial institution should understand how the vendor protects customer information.
The FTC’s Safeguards Rule also places responsibility on covered institutions to take steps to ensure that affiliates and service providers safeguard customer information in their care.
A strong vendor-management process should therefore consider:
- Chain of custody
- Asset tracking
- Data sanitization method
- Verification
- Reporting
- Employee controls
- Final disposition
- Contractual responsibilities
For onsite projects, onsite data wiping and IT asset disposition can provide a controlled alternative to moving sensitive equipment unnecessarily.
Data Sanitization Pro for Financial Institutions
Data Sanitization Pro is a Made-in-India data sanitization platform designed for enterprise, government, defence and other organizations that need controlled and verifiable data erasure.
The platform supports multiple storage technologies including HDD, SSD, NVMe, USB, removable media, RAID, NAS, SAN and other supported storage environments. It also supports sanitization methodologies including NIST 800-88 Clear, NIST 800-88 Purge, DoD 5220.22-M, Secure Erase, Enhanced Secure Erase and organizationally defined methods.
Its capabilities include verification, real-time monitoring, device identification, SMART health information, bad-sector assessment, audit logging and PDF/HTML reporting.
For financial institutions processing large numbers of retired devices, this can support a workflow such as:
Identify → Sanitize → Verify → Report → Dispose or Reuse
The software can therefore be positioned as a technical control within a broader GLBA information-security and disposal program, rather than as a standalone guarantee of GLBA compliance.
Learn more about: Data Sanitization Pro.
GLBA Data Destruction Checklist
Before disposing of financial customer data organizations should consider:
- Confirm the data is eligible for disposal
- Check legal and business retention requirements
- Identify all storage locations
- Record asset IDs and serial numbers
- Identify HDD, SSD, NVMe or other media
- Select an appropriate sanitization method
- Verify the sanitization result
- Maintain an audit trail
- Document the final disposition
- Review third-party vendor controls
- Retain required reports and evidence
For physical destruction projects, a Certificate of Destruction can form part of the documentation package, but the certificate should be supported by proper asset tracking and destruction records.
Common GLBA Data Disposal Mistakes
Deleting Files Manually
Deleting files is not the same as secure data sanitization.
Using Quick Format
Formatting a drive should not automatically be treated as a complete compliance process.
Applying an HDD Method to Every SSD
Different storage technologies require different considerations.
Ignoring Retired Backup Media
Customer information can remain on backup devices and older storage.
Choosing Software Only Because It Says “GLBA Compliant”
The better approach is to evaluate the actual technical capabilities, verification, reporting and audit controls.
Ignoring Vendors
Outsourcing disposal does not remove the need for appropriate vendor oversight.
Final Takeaway
GLBA compliance and data erasure software are closely connected, but software alone does not create GLBA compliance.
Financial institutions need an information-security program that protects customer information throughout its lifecycle, including when information is no longer needed.
For FTC-regulated institutions, the Safeguards Rule requires security measures for customer information, while the FTC Disposal Rule requires reasonable measures to protect certain consumer-report information during disposal.
The strongest approach is therefore:
- Identify the data.
- Identify the media.
- Choose an appropriate sanitization method.
- Verify the result.
- Document what happened.
- Control final disposition.
For organizations managing sensitive financial information, professional data sanitization software can make this process more consistent, scalable and auditable.
Data Sanitization provides professional data sanitization and IT asset disposal services for HDDs, SSDs, flash storage, mobile devices and enterprise storage.
For organizations that need software-based, verifiable and report-driven media sanitization, Data Sanitization Pro provides a dedicated platform for controlled data erasure workflows.
Related Data Sanitization Guides
Frequently Asked Questions
What are the GLBA requirements for data disposal?
GLBA-related requirements require covered financial institutions to protect customer information through appropriate safeguards. The FTC Safeguards Rule includes secure disposal of customer information, while the FTC Disposal Rule requires reasonable measures to protect certain consumer-report information during disposal.
Does GLBA require data destruction software?
No. GLBA does not mandate a particular data destruction software product. Organizations should implement appropriate security and disposal controls based on their regulatory obligations, risk and information-security program.
What is GLBA data disposal?
GLBA data disposal is the secure handling and disposal of customer information when it is no longer needed, using reasonable measures designed to prevent unauthorized access or use.
Is NIST 800-88 required for GLBA compliance?
What is the best data erasure software for financial institutions?
The best solution depends on the organization’s media types, security requirements, scale and reporting needs. Look for HDD/SSD/NVMe support, appropriate sanitization methods, verification, asset tracking, audit trails and detailed reporting rather than selecting software solely because it advertises “GLBA compliance.”
How should banks securely dispose of old hard drives?
Banks should first determine whether the information is eligible for disposal, identify the media, select an appropriate sanitization or destruction method, verify the result and retain asset-level documentation. If equipment is outsourced to an ITAD or destruction vendor, vendor security and chain-of-custody controls should also be evaluated.
Can a financial institution reuse a wiped computer?
Yes, when the organization’s policies and applicable requirements permit reuse and the data has been appropriately removed. The sanitization method should match the media and the required level of protection.
Need Onsite Data Sanitization Services?
Do you want Data Sanitization Services to be provided at your location? No worries!! We got it covered. Our team members will be appointed to finish the job at your location after you book the appointment with us. Please feel free to contact us.
