Data protection law is often read as being about systems, passwords and consent forms. In practice, a striking share of reported breaches involve paper — files left in a skip, records posted to the wrong address, boxes abandoned in a vacated office. Disposal is part of security, and the law treats it that way.
What the law actually says
UK GDPR requires appropriate technical and organisational measures to keep personal data secure against unauthorised access, loss or destruction, for the whole time you hold it — including the moment you get rid of it. It also requires you not to keep personal data longer than necessary. Together those two duties mean you must dispose of records when their purpose ends, and do it securely.
What the law does not do is name a machine, a shred size or a supplier. "Appropriate" is judged against the sensitivity of the data and the harm a breach would cause. Destroying a list of former employees' medical absences demands more care than destroying an old stationery order.
Duty of care follows the waste
Separately from data protection, waste law imposes a duty of care on the business producing commercial waste. You must ensure it is handled only by an authorised person and transferred with an accurate description. A registered waste carrier is not an optional extra — you can check any carrier on the Environment Agency's public register, and it takes a minute.
The practical consequence is that you cannot discharge responsibility by putting confidential paperwork outside the back door. Until it has been properly transferred and destroyed, it is still yours.
The mistakes that lead to enforcement
Reported cases tend to share a small number of causes. Bags of shredded or intact paper left beside a commercial bin. Filing cabinets and boxes left behind when an office lease ends. Records taken home "to shred later". Old computers and hard drives sold, donated or skipped without being wiped or destroyed. Confidential paperwork used as scrap — printed on the reverse, or handed out as note paper.
None of those involve a sophisticated attacker. They involve ordinary workplace convenience, which is why policy alone does not fix them. What fixes them is making the secure route the easiest route: lockable consoles where staff already work, so putting a document somewhere safe takes less effort than carrying it to a bin.
What good disposal looks like in practice
- Lockable containers on site for material awaiting destruction, so nothing sensitive sits in an open bin or a stacked box.
- A registered waste carrier with vetted staff, verifiable on the public register.
- Cross-cut destruction rather than strip-cut, which can be reassembled.
- A documented chain of custody if the material is destroyed away from your premises — sealed containers, recorded collection, destruction on arrival.
- A Certificate of Destruction for every collection, recording the date and the volume destroyed.
- Recycling of the shredded material, which most organisations now need for their own environmental reporting.
Keep the paperwork that proves it
If a regulator asks what happened to a record, "we shredded it at some point" is not an answer. A Certificate of Destruction is. Keep certificates with your retention schedule, and you can demonstrate the full lifecycle of a record: why you held it, how long for, and how it was destroyed. That combination is what turns a policy document into a defensible position.
The same applies to devices. When hard drives, tapes and USB media are destroyed, ask for a listing of serial numbers so your IT asset register and your destruction evidence agree with each other.
Make it somebody's job
Disposal fails quietly when it belongs to everyone and therefore nobody. Name the person responsible, put the retention schedule where staff can find it, brief new starters on what goes in the secure console, and book collections on a schedule rather than when the store cupboard fills up. A recurring collection is cheaper per visit than repeated emergency clear-outs, and it means the pile never grows large enough to become a risk in its own right.
Getting help
If you are not confident that your current disposal arrangements would stand up to scrutiny, the fastest way to find out is to walk the route a confidential document takes from a desk to destruction, and look for the point where it stops being under control. Most businesses find it in the first five minutes.
For secure, certificated document and media destruction anywhere in the North East, call 0333 360 8269 or request a free quote. Every collection comes with a Certificate of Destruction for your compliance file.