When a financial entity retires a laptop, server, or storage array, the data on it does not retire with it. Under the EU’s Digital Operational Resilience Act, what happens to that data, and to the device itself, is now part of a regulated ICT risk management framework. The Digital Operational Resilience Act (DORA) Regulation (EU) 2022/2554 entered into force on 16 January 2023 and became applicable on 17 January 2025, following a 24-month period between entry into force and application. It establishes requirements for financial entities in the European Union to manage ICT risks and protect the availability, authenticity, integrity, and confidentiality of data. DORA establishes a common framework for digital operational resilience across a broad range of financial entities, including credit and payment institutions, investment firms, crypto-asset service providers, institutions for occupational retirement provision, insurance and reinsurance undertakings, and credit rating agencies, among others.
The regulation covers key areas such as:
- ICT Risk Management
- Incident Reporting
- Digital Operational Resilience Testing
- Information and Intelligence Sharing
- ICT Third-party Risk Management
Its supporting RTS, set out in Commission Delegated Regulation (EU) 2024/1774, establish requirements for data and system security, including the secure deletion of data that is no longer needed and the disposal or decommissioning of storage devices containing confidential information. These requirements make controlled data erasure and secure device disposition relevant to the implementation of DORA's data and system security requirements.
What are the DORA Requirements for Data and ICT Asset Security?
The following DORA provisions are particularly relevant to how financial entities identify, protect, manage, and recover information and manage the ICT assets that store and process it.
- DORA Article 6 - ICT Risk Management Framework: Article 6 requires financial entities to maintain a comprehensive ICT risk management framework covering policies, procedures, protocols, and tools to protect information and ICT assets. The supporting RTS specify requirements for areas including ICT asset management, encryption, ICT operations, network security, and data and system security.
- DORA Article 8 – Identification: Article 8 requires financial entities to identify, classify, and document their information and ICT assets and the business functions they support. RTS Article 4 requires an ICT asset management policy covering the asset lifecycle and records such as identifiers, locations, classifications, owners, dependencies, and ICT third-party support end dates.
- DORA Article 9 - Protection and Prevention: This article requires measures to protect the resilience, continuity, and availability of ICT systems and the availability, authenticity, integrity, and confidentiality of data. The supporting RTS specifies additional security measures relating to access control, secure configurations, authorized software and storage media, endpoint security, and prevention of data loss and leakage.
- DORA Article 12 - Backup Policies and Procedures: Article 12 requires documented backup, restoration, and recovery procedures, along with measures to protect and periodically test backup systems. The supporting RTS addresses backup and restore requirements under ICT operations.
- DORA Article 13 - Learning and Evolving: This article requires financial entities to gather information on vulnerabilities, cyber threats, and ICT-related incidents and conduct post-incident reviews following major ICT-related incidents that disrupt core activities to identify improvements to ICT operations and digital operational resilience. Where a review traces data exposure to improperly decommissioned media, the findings should feed back into disposal and erasure procedures.
The supporting RTS also covers secure de-installation and legacy systems. Most importantly for data erasure, RTS Article 11 requires processes to securely delete data that is no longer needed and securely dispose of or decommission storage devices containing confidential information.
How do DORA Requirements Address Data Removal?
Commission Delegated Regulation (EU) 2024/1774 establishes specific requirements for data and system security. Article 11 requires financial entities to develop, document, and implement a data and system security procedure.
Article 11 sits in Title II of the RTS, which applies to most financial entities. Entities eligible for the simplified ICT risk management framework under DORA Article 16 follow Title III of the RTS instead.
Several provisions are particularly relevant to data erasure, device disposition, and data protection:
- RTS Article 11(2)(g) - Secure Deletion of Data: Requires a process to securely delete data, whether stored on the financial entity's premises or externally, when it is no longer needed for collection or storage.
- RTS Article 11(2)(h) - Secure Disposal or Decommissioning of Data Storage Devices: Requires a process to securely dispose of or decommission storage devices containing confidential information, whether located on the financial entity's premises or externally.
- RTS Article 11(2)(f)(i) - Remote Wiping: Requires a management solution for portable and private non-portable endpoint devices that enables remote management and remote wiping of the financial entity's data.
- RTS Article 11(2)(i) - Data Loss and Leakage Prevention: Requires security measures to prevent data loss and leakage for systems and endpoint devices.
- RTS Article 12 – Logging: Requires financial entities to implement documented logging procedures, including defined log retention periods and measures protecting logs against tampering, deletion, and unauthorized access.
These provisions establish requirements for secure data deletion, storage-device disposition, endpoint wiping, data loss prevention, and logging within the broader ICT security framework.
What is the Role of Secure Data Deletion in Ensuring DORA Compliance?
Secure data deletion, or data erasure, can help financial entities operationalize the processes required by DORA's supporting RTS for securely deleting data that is no longer needed and securely disposing of or decommissioning data storage devices containing confidential information. A software-based data wiping solution such as BitRaser Drive Eraser can support these processes through controlled erasure, verification, and reporting across supported storage media.
- Securely Deletes Data: Data erasure solutions can erase data from supported storage devices, including HDDs, SSDs, and NVMe drives used in laptops, desktops, and servers. This capability can be incorporated into documented data deletion and asset disposition procedures under RTS Article 11(2)(g) and (h).
- Addresses Hidden Storage Areas: Where supported by the device and erasure method, BitRaser can address hidden areas such as Host Protected Area (HPA), Device Configuration Overlay (DCO), and remapped sectors. This can help address residual data that may exist outside conventional user-accessible storage areas.
- Verifies Erasure: Erasure verification can provide an additional control for confirming that a deletion process was completed as intended. Verification methods may vary depending on the device, technology, and selected erasure method.
- Creates Supporting Records: Erasure solutions can generate certificates and detailed reports documenting the device, erasure process, and outcome. Such records can support internal audit, asset disposition, and compliance activities.
- Supports Remote Wiping: For supported endpoint environments, remote wiping can allow organizations to erase data without physically accessing the device. This can support the remote wiping requirement in Article 11(2)(f)(i) where the device and deployment environment meet the applicable conditions.
- Supports Standardized Erasure at Scale: Centralized erasure workflows can allow organizations to standardize erasure methods, configure deployment images, and process multiple drives simultaneously. This can help IT teams and ITAD providers apply consistent procedures across large asset volumes.
When Disposal activity is Outsourced:
Outsourcing device disposition to an ITAD provider does not transfer the obligation. RTS Article 11(2)(g) and (h) apply to data and devices whether they sit on the financial entity’s premises or externally, and outsourced arrangements may also fall within DORA’s ICT third-party risk requirements (Articles 28 to 30). Device-level erasure certificates give financial entities verifiable evidence they can review as part of that oversight, rather than relying on a vendor’s summary statement.
These capabilities can help financial entities establish repeatable processes for secure data deletion, storage-device disposition, verification, and supporting documentation. DORA and its supporting RTS do not prescribe a specific commercial erasure product or sanitization technology. Aligning erasure and verification with recognized sanitization standards, such as NIST SP 800-88 Rev. 2 and IEEE 2883-2022, can help demonstrate that the chosen method is appropriate. Organizations must determine appropriate technical and organizational measures based on their ICT risk, data classification, internal policies, procedures, applicable data retention requirements (including the GDPR storage limitation principle in Article 5(1)(e)), and other legal and regulatory obligations.
Conclusion
DORA makes secure deletion and device disposition part of how financial entities demonstrate digital operational resilience. A documented process, verified erasure, and device-level records turn those RTS requirements into something an auditor can check.
