The short answer. A Georgia business disposes of old hard drives by having the data destroyed to a documented standard before the drives leave its control, then recycling the metal and boards. American Resources collects retired drives and SSDs from businesses across metro Atlanta, destroys them, and closes each job with a certificate of destruction that lists every drive by serial number.
Hard drives are the one item in an office cleanout where "dispose" and "recycle" are the wrong words. The drive is a record. Until the data on it is gone, it is a copy of everything the machine ever held: customer files, payroll, email, scans, credentials. Georgia has no state law written for hard drives, so the rules that apply are the federal ones that attach to the data, and the standard everyone measures against is NIST's.
#The three levels NIST recognizes
NIST Special Publication 800-88, revised in September 2025, is the reference document for media sanitization in the United States. It defines three levels.
Clear is "a method of sanitization that applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user." In plain terms: overwriting through the drive's normal interface. It protects against someone plugging the drive in and looking.
Purge applies "physical or logical techniques that make the recovery of target data infeasible using state-of-the-art laboratory techniques but preserves the ISM in a potentially reusable state." Cryptographic erase and firmware-level secure erase sit here. The drive can be reused afterwards.
Destroy "renders target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the ISM for the storage of data." Shredding, crushing and disintegration. The drive is gone.
Which level a business needs depends on what the drive held and what the business has promised about it. Drives from finance, healthcare, legal or HR machines usually go to Destroy, because it is the only level that leaves nothing to argue about later.
#Why a factory wipe is not the end of the job
Deleting files, formatting a drive or restoring a computer to factory settings removes the index, not the data. NIST notes that for some devices "manufacturer resets and procedures that do not include rewriting may be the only clear sanitization technique options," which is exactly why Clear is the lowest of the three levels. A drive that has only been formatted is a drive whose data is still there.
Solid-state drives add a second problem: wear-leveling means an overwrite through the operating system does not reach every cell. For SSDs the choices are the manufacturer's secure-erase command, cryptographic erase where the drive was encrypted from day one, or physical destruction sized for flash chips.
#What the law expects of a Georgia business
There is no Georgia statute for hard-drive disposal. The obligations come from the data. A business that holds consumer report information must take "reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal," and the rule names "destruction or erasure of electronic media containing consumer information so that the information cannot practicably be read or reconstructed." A financial institution under the FTC Safeguards Rule, which includes car dealers that arrange financing, must "develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used." A medical practice must "implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored." None of these rules names a method. All of them expect a record.
#What the record has to say
NIST's sample certificate of sanitization records the manufacturer, model and serial number of each device, the media type, the sanitization method and technique, the tool used, the verification method, and the name, position, date and signature of the person who performed and verified the work. That list is the test to apply to any recycler's certificate: if it does not name your drives one by one, it is a receipt, not a certificate. Our certificate of destruction page shows the fields we record.
#How the pickup works
Count the drives, or leave them in the machines and tell us how many machines. Loose drives travel in a sealed container with a count; drives still inside computers are pulled at our facility and logged against the machine's asset tag. Every drive is recorded before destruction, and the chain of custody runs from your dock to the shredder.
Ready to clear a drawer of drives, or a rack? Request a hard drive destruction quote or send a rough count through the contact form.
