Hardware

Servers and racks at end-of-life: destruction in the data centre

21 May 2026 · 8 min read · DeSnipperaar

A data centre decommissioning is an operation of a different calibre than a batch of office laptops. Dozens of servers, storage arrays with hundreds of disks, switches, sometimes a tape library on top. The physical logistics are substantial; data destruction requirements are often elevated by customer contracts, audits or certifications. On-site destruction is often the only defensible route here. This article describes the approach.

What will you destroy?

Servers: rackmount or blade. HDD or SSD for the system; sometimes separate data disks.
Storage arrays (SAN/NAS): tens to hundreds of disks per chassis. Large enterprise systems can hold several dozen kilos of disks.
Switches and routers: usually little persistent data, but configurations contain network information.
Tape libraries: separate cartridges plus the drive units themselves. See also clearing backup tapes and LTO.
UPS and PDU units: typically no data, but a waste stream.
Cabling: recyclable metal stream, no destruction requirement.

The approach in five phases

Phase 1: Inventory

List per device with:

Asset tag or serial number.
Internal media type (number of HDDs/SSDs, type, capacity).
Encryption present (volume- or self-encrypting drives).
Classification of data that was on the system.

This list is the basis for the eventual certificate. Reckon on a working day of inventory for a 42U rack.

Phase 2: Preparation

Verify backups where data is still needed elsewhere.
Logical decoupling: take servers out of cluster, take storage offline.
Crypto-erase via secure-erase command where possible: this weakens the data before the physical shred.
Loosen screws and disk caddies for faster extraction.

Phase 3: On-site destruction

Our mobile truck drives to the data centre. Per media type:

HDD: shred to DIN H-4 or H-5.
SSD: separate E-shredder for fine particle size (NAND chip larger than H-4 particles).
Tapes: separate stream or in the same run.
Switches/routers: shred the whole device or dismount the config board separately.

For the choice between H-levels and the trade-off between degaussing versus shredding versus crushing, see the matching article.

Phase 4: Documentation

Certificate with serial number list per device.
Timestamps of start and end of destruction.
Operator signature.
Optional photo report or video documentation.
Statement of method and DIN classification per type.

Phase 5: Material stream

Metal to the metal recycler.
Plastic to the plastic recycling stream.
Magnets and rare earth metals separated where economically sensible.
Batteries disposed of separately.

A mobile truck typically processes 200 to 400 disks per day. For a storage array of 1,000 disks, reckon on 3 to 4 days on-site.

Chain of custody in data centre context

The chain in a data centre decommissioning is distinctive:

Server in rack (in secured data centre).
Server out of rack to workspace.
Disks out of server into locked carts.
Carts to mobile truck (also within secured data centre premises).
Destruction in truck.
Residue stays in sealed compactor.
Truck leaves data centre with unreadable residue stream.

The chain is fully within your data centre perimeter until step 6. No disks leave the site while still readable. For the broader chain analysis, see chain of custody from archive to shredder.

Audit requirements: what customers ask

ISO 27001: requires secure disposal to be documented. Our certificate meets this.
SOC 2: chain of custody plus method. Also covered.
HIPAA (for healthcare-related data): sanitisation per NIST 800-88. We deliver a Purge or Destroy classification per device.
PCI-DSS: media destruction required; ask specifically for a PCI-DSS clause in the quote.
GDPR: "appropriate technical measure". Destruction certificate is evidence.

For IT managed service providers

MSPs arranging data centre decommissioning for clients have extra contractual requirements: per-device certificate, fast turnaround, evidential chain. For a write-up specifically for MSPs, see our IT MSPs page.

Timeline

A data centre decommissioning is not an afternoon job. Realistic planning:

Phase	Lead time
Inventory	1 to 3 working days
Preparation (backups, decommissioning)	1 to 5 working days
On-site destruction	1 to 5 working days
Certificates and reporting	1 working day
Metal/plastic logistics	1 to 2 working days

On-site destruction in the data centre.

We drive the truck to your colocation or own data centre. Disks only leave your perimeter as unreadable residue. With a serial number list certificate.