What NAND Wiping, DoD 5220.22-M, and Blancco Mean for Bulk Device Sellers

Why Data Wiping Is a Selling Requirement, Not Just Best Practice

In most jurisdictions, selling or exporting a device that contains personal data without proper erasure exposes the original owner — and potentially the seller — to data protection liability. Under GDPR in the EU and UK, personal data on a device remains the responsibility of the data controller until it is properly destroyed or erased. A factory reset does not meet this standard.

Factory Reset vs Certified Erasure

A factory reset removes the user interface access to data but does not overwrite the underlying NAND storage. With the right tools, data can be recovered from a factory-reset device. Certified erasure software — such as Blancco, iShredder, or tools compliant with DoD 5220.22-M — overwrites storage sectors multiple times, making recovery forensically impossible.

Common Erasure Standards

DoD 5220.22-M — The US Department of Defense erasure standard. Involves multiple overwrite passes. Widely recognised as the benchmark for thorough data destruction.

NIST 800-88 — The US National Institute of Standards and Technology guideline. Increasingly adopted as the modern standard for solid-state storage, as overwrite passes on flash memory have diminishing returns compared to cryptographic erasure.

Blancco — A leading commercial erasure software platform that provides certified, auditable erasure reports per device. Widely accepted by corporate IT teams and data protection officers as proof of erasure.

What Sellers Should Do

If you are selling corporate devices, ensure MDM unenrolment and certified erasure are completed before shipment where possible. If this is not practical at scale, HK Saitong offers certified data wiping as part of our intake process. Ask about this service when you contact us via WhatsApp.