0 Items

Are Data Tapes Still Relevant — And What Should We Do with Them?

By: Jeff Datkuliak, IAITAM Instructor

During a recent CITAD course, someone asked,

“We have an accumulation of data tapes, and we’re not sure what to do with them or who can process them.”

It was a question that was both humorous and a little alarming. It came from someone newer to the field who may not realize that, not long ago, data tapes were the standard for backup and archival storage across nearly every organization.

While their use has declined, data tapes are still regularly encountered during asset disposition. And like all data-bearing assets, they require a documented, validated process to ensure proper handling and secure destruction — especially to meet compliance and regulatory requirements.

So… What Should We Do with Data Tapes?

If you have legacy data tapes sitting in storage, here’s what you should know:

    • Include them in your documented data disposition process.
      Treat tapes with the same rigor you apply to hard drives and other storage media.
    • Recognize that they likely contain sensitive or protected information. This makes them subject to industry compliance standards (e.g., HIPAA, GDPR, PCI DSS, etc.).
    • Best practice: Degauss or destroy.
      Data tapes store information magnetically. The most cost-effective and compliant method for rendering them unreadable is degaussing — which follows NIST SP 800-88 standards for media sanitization.
      • Degaussing scrambles the magnetic fields, making data permanently unrecoverable.
      • After degaussing, physical destruction (e.g., shredding or incineration) is often used as a secondary measure.

Other Media Considerations

Degaussing only works for magnetic media though. For other data-bearing items, different methods apply:

    • CDs/DVDs, Microfiche, ID Badges:
      These should be physically destroyed — shredding or incineration is recommended under NIST 800-88.
    • Environmental and waste considerations:
      Be aware of potential environmental impacts with incineration or e-waste. Choose certified vendors who follow responsible recycling practices.

Key Takeaways

• Don’t ignore or forget about legacy data tapes — they still pose real security and compliance risks.
• Treat all data-bearing assets (past and present) with the same care.
• Document your processes, align with NIST 800-88, and ensure all asset types have appropriate end-of-life procedures.

Don’t leave your risk to chance – define and document your data-bearing assets and their disposition process.