How are null updates performed on tablespace level?

We are going through a PCI audit and a question of how values are updated with NULL for confidential data. If you remove a value by setting it to NULL does that remove the data from the disk? Is a pointer just removed which would allow someone to be able to retrieve that data possibly? I have had discussions on hard drive and OS data from file deletions, but have not discussed it in a database type perspecitve. Can someone shed light on this. I have searched around, but only find references to possibility that there is not a reference