This is the English edition. The article body below is the publisher's English rendering of the original Chinese article; figures, license numbers and institutional names follow the original.

The mandatory national standard Data Security Technology — Technical Requirements for Information Erasure of Electronic Products has been published and will take effect on January 1, 2027. It applies to electronic products produced or sold within China that contain non-volatile storage media, covering mobile phones, tablets, laptops, desktops, smart wearables, office equipment, and more.

"Information Erasure" Is Not "Deletion"

The standard distinguishes two concepts: ordinary deletion or a factory reset often merely marks data as invalid, and the data may still remain on the storage medium; "information erasure" means technical processing of the data on the storage medium so that it becomes irreversible and cannot be accessed or recovered.

Two Core Technical Methods

  • Data overwriting: writing fixed or random meaningless data into the product to cover every storage cell associated with user data. Magnetic media require at least 3 overwrite passes including 1 random-number pass; semiconductor media require at least 1 pass.
  • Block erasure: for semiconductor media, invoking storage media commands to perform a fundamental erasure of physical blocks.

Who Bears the Erasure Responsibility

  • Electronics manufacturers: must provide users with built-in erasure functions; where a built-in function cannot be developed, they must supply an external erasure tool, inform users of available third-party tools, or provide free erasure services. Before execution, the scope, method, and impact of erasure must be clearly disclosed and user consent obtained.
  • Second-hand electronics recycling operators: proactively prompt users to erase data before purchase; accessing or retaining user data without consent is prohibited; erasure must use functions or tools conforming to the standard; where the product is damaged and software erasure is impossible, the storage medium must be physically destroyed; erasure effectiveness must be verified before resale, and products with uncleared user data may not be resold or transported out of the country; archives of erasure operations and verification results must be kept for no less than 3 years.

What It Means for Corporate Asset Disposal

The standard extends "data erasure" from an internal management practice to a statutory duty along the recycling and disposal chain. When disposing of IT assets containing business or customer data, enterprises should require the contractor to provide standard-compliant information erasure or physical destruction certificates and file them — both a data compliance requirement and evidence for later audits.

How to Accept Erasure Work

The standard sets technical requirements, but in practice the commissioning party's biggest question is "how do I confirm it is really clean." Three workable acceptance steps:

  • Check the method — whether overwriting, block erasure, or media destruction was used; the method must match the media type and the data sensitivity level.
  • Check the records — the erasure time, operator, tools used, and results for each device should be recorded and traceable to specific serial numbers.
  • Sample verification — sample a proportion of devices and attempt data recovery to confirm that no readable original data remains on the erased media.

Only when all three are done is the erasure process auditable. A verbal "it's been erased" will not stand up in audits or regulatory inspections.

For bulk disposal, sampling ratios and verification records are best written into the contract: most post-hoc disputes are not about "whether it was erased" but "how do you prove it was." Agreeing on acceptance methods upfront saves far more trouble than producing evidence afterwards.

Source

Policy interpretation by the Yangdong District People's Government of Yangjiang City: yangdong.gov.cn.