Skip to content
RECYCLICTECH

Knowledge

GBA / APD: what counts as proof of data destruction in Belgium

Belgium’s Data Protection Authority expects traceable destruction per drive. A recycling ticket does not close the GDPR file.

Request assessment
Overheids-IT in Brussel klaar voor GDPR-conforme ophaling en datavernietiging

The APD reads serials, not intent

GDPR applies directly in Belgium. The Data Protection Authority (APD / GBA) supervises. Article 5(1)(f) and Article 32 still apply until personal data on the drive is unrecoverable. A retired blade in a Brussels government cage is not furniture.

Internal audit and the DPO want method (NIST SP 800-88 Clear, Purge or physical destruction), timestamp, serial or unique media ID, and who held the chain of custody. RecyclicTech issues that line per drive. We do not invent a Belgian accreditation or an unpublished ISO 27001 mark.

Erasure keeps residual value. Shredding ends reuse. The briefing chooses. Both finish with the same evidence rule. A PDF of recycled kilograms with no link to the drive is worthless to the APD.