Reuse and Disposal of Information Assets

Procedures for the secure reuse and disposal of information assets must be established and implemented.

• Information asset reuse procedure: data initialization methods, reuse processes, etc.
• Information asset disposal procedure: disposal methods, disposal processes (approval, etc.), disposal confirmation, recording in a disposal management ledger, etc.

When information assets and storage media are reused or disposed of, personal information and important information must be processed in a manner that prevents recovery.

• When destroying personal information, it must be safely destroyed in accordance with the law so that it cannot be recovered or restored.

  ※ Methods of destruction that make restoration impossible (examples)

  1. Complete destruction (incineration, shredding, etc.)
  2. Deletion using dedicated degaussing equipment (degausser)
  3. Performing initialization or overwriting so that data cannot be restored

• The term "method that makes restoration impossible" refers to a method of taking measures so that the destroyed personal information cannot be restored at a socially reasonable cost given the current level of technology (Article 10 of the Standard Personal Information Protection Guidelines).

When information assets and storage media are disposed of internally, the disposal history must be kept in a management ledger that includes the following, and evidence of disposal confirmation must be retained together.

• Date of disposal
• Name of the person in charge of disposal and the name of the verifier
• Method of disposal
• Evidence of disposal confirmation (photographs, etc.)

When information assets and storage media are disposed of through an external company, the disposal procedure must be specified in the contract, and it must be verified whether disposal was carried out completely in accordance with that procedure.

• Reflect the disposal procedure, protective measures, and allocation of responsibility, etc., in the contract.
• Verify evidence of implementation, such as photography and on-site inspection, to confirm whether disposal is being carried out in accordance with the disposal procedure reflected in the contract.

In the course of maintaining or repairing information systems, PCs, etc., when storage media replacement or recovery occurs, measures must be prepared to protect the information within the storage media.

• Migrating and destroying data before requesting maintenance
• Data encryption
• Confidentiality pledge at the time of contract
• Complete deletion of data or complete destruction of storage media, etc.