Point of Sale Destruction

Data Destruction Inc. destroys retired point-of-sale terminals, PIN pads, and registers by sanitizing every component that stored cardholder data to NIST SP 800-88 r2 and PCI DSS Requirement 9.4.

A retired payment terminal is a compliance liability with a card reader attached. POS devices store cardholder data, encryption keys, and application data in flash and secure elements, and PCI DSS requires that media to be destroyed when it is retired. Deleting transactions or resetting the device does not satisfy that obligation.

TOP 10 WAYS TO PROTECT YOUR PRIVACY NOW!

DOWNLOAD YOUR FREE GUIDE

DOWNLOAD NOW

Related Destruction Services

What is point of sale destruction?

Point of sale destruction is the secure destruction of the data-bearing components inside payment terminals, PIN pads, card readers, and POS registers so cardholder data cannot be recovered. It applies both a NIST SP 800-88 r2 media sanitization outcome and the PCI DSS requirement to destroy media when it is no longer needed.

POS hardware stores data in embedded flash, secure elements, and sometimes internal drives on register systems. Because flash cannot be reliably overwritten and cannot be degaussed, physical destruction is the dependable outcome, with any conventional drives sanitized by their media type.

Attribute	Value
Equipment class	POS terminals, PIN pads, card readers, registers
Data-bearing parts	Embedded flash, secure element, internal HDD or SSD
Flash and secure element destruction	Shred to small particle size
Register drive destruction	Shred, or shred or degauss for HDD
Data at risk	Cardholder data, encryption keys, transaction records
Governing frameworks	PCI DSS Requirement 9.4 and NIST SP 800-88 r2

How does point of sale destruction work?

Point of sale destruction works by identifying every component that stored payment data, destroying each, and documenting the result for PCI evidence. Data Destruction Inc. follows a documented sequence.

Inventory and scan terminals, capturing serials under documented chain of custody.
Identify flash, secure elements, and any register drives.
Shred flash and secure elements; shred or degauss register drives.
Record serials, methods, particle sizes, and operator sign-off.
Route residue to responsible downstream recovery, then issue the Certificate of Destruction.

Where POS registers use conventional drives, the drive-level methods are those on our Hard Drive Shredding page, applied inside a controlled workflow that produces PCI-ready evidence.

Why PCI DSS requires destruction, not deletion

PCI DSS requires destruction rather than deletion because deleted transactions and reset devices can still hold recoverable cardholder data. Understanding the requirement clarifies the control.

Requirement 9.4 calls for media containing cardholder data to be destroyed when it is no longer needed for business or legal reasons.
Flash retention means a reset or deletion can leave account data in reserve cells that a lab could recover.
Documentation is part of compliance, so a serialized certificate provides the evidence a QSA expects.

Because the storage is flash-class memory, it follows the same rule as USB / Flash Drive Destruction: physical destruction is the reliable path to a Destroy outcome for cardholder data.

How does point of sale destruction meet compliance obligations?

Point of sale destruction meets compliance obligations when every component that stored cardholder data is destroyed and the outcome is documented per device. The map below ties common rules to our process.

Standard or rule	Requirement	Data Destruction Inc. process
PCI DSS Requirement 9.4	Destroy media with cardholder data when retired	Destroy POS flash, secure elements, and drives, serialized proof
NIST SP 800-88 r2	Match method to media, verify	Shred flash, shred or degauss drives, log serials
GLBA Safeguards Rule, 16 CFR Part 314	Dispose of customer information securely	Serialized destruction of payment hardware
FACTA Disposal Rule, 16 CFR Part 682	Dispose of consumer report information properly	Destroy media holding consumer data with proof

PCI DSS is an industry standard rather than a federal regulation. For the government-published sanitization method, read our blank” rel=”noopener”>NIST SP 800-88 r2 guidelines and the FTC guidance on disposing of consumer report information.

Which industries need point of sale destruction?

Any business that accepts cards retires POS hardware, and three sectors carry concentrated exposure.

Retail. Store fleets cycle terminals and registers constantly, making retail data destruction a recurring need.
Financial services. Payment processors and banks retire card-handling hardware under financial data destruction programs.
Manufacturing. Plant stores and cafeterias run POS systems that fall under manufacturing data destruction policies.

What you receive after point of sale destruction

Every engagement produces a PCI-ready documentation package.

Serialized Certificate of Destruction, provided within 24 hours after the destruction event is complete.
Chain-of-custody log from pickup through destruction.
Asset inventory listing terminal serials and component types.
Method record noting sanitization method and particle size.
Downstream recovery record confirming responsible recycling.

See the blank” rel=”noopener”>Certificate of Destruction and blank” rel=”noopener”>Chain of Custody pages for details.

Frequently asked questions

Can't we just delete transactions from the terminal?

No. Deleting transactions or resetting a terminal can leave cardholder data in flash. PCI DSS Requirement 9.4 calls for the media to be destroyed, with documentation.

Does PCI DSS actually require destruction?

PCI DSS Requirement 9.4 requires media containing cardholder data to be destroyed when it is no longer needed. A serialized Certificate of Destruction provides the evidence for your assessment.

Do you destroy PIN pads and card readers too?

Yes. We destroy the flash and secure elements in PIN pads, card readers, and terminals, along with any drives in register systems.

Do you work on-site at store locations?

Yes. We offer on-site destruction with witnessed options and secure off-site service under chain of custody. Call (866) 850-7977.

What proof do we receive?

A serialized Certificate of Destruction, a chain-of-custody log, and an asset inventory with serials, ready for QSA review.

What happens to the hardware?

After the storage is destroyed, hardware is routed to responsible downstream recovery and recycling, recorded in your package.

Get Started

Retire payment hardware with PCI-ready proof. Schedule point of sale destruction at contact us or call (866) 850-7977.

LET US CONTACT YOU

Latest Blog posts

Posts not found

SEARCH LOCATION WITH ZIP CODE

Point of Sale Destruction

Related Destruction Services

Computer Equipment Destruction

Network Equipment Destruction

USB / Flash Drive Destruction

Hard Drive Shredding

What is point of sale destruction?

How does point of sale destruction work?

Why PCI DSS requires destruction, not deletion

How does point of sale destruction meet compliance obligations?

Which industries need point of sale destruction?

What you receive after point of sale destruction

Frequently asked questions

Can't we just delete transactions from the terminal?

Does PCI DSS actually require destruction?

Do you destroy PIN pads and card readers too?

Do you work on-site at store locations?

What proof do we receive?

What happens to the hardware?

Get Started

LET US CONTACT YOU

DATA DESTRUCTION LOCATIONS

SHREDDING SERVICES DALLAS

SHREDDING SERVICES NEW YORK CITY

SHREDDING SERVICES SAN JOSE

SHREDDING SERVICES SAN DIEGO

SHREDDING SERVICES LOS ANGELES

SHREDDING SERVICES IRVINE

SHREDDING SERVICES WASHINGTON

Posts not found

download your free guide!

The Top 10 Ways to Protect Your Privacy Right Now!