The short answer
BS EN 15713 is the European code of practice for the secure destruction of confidential and sensitive material, adopted as a British Standard. The current edition, BS EN 15713:2023, was published on 30 September 2023 and replaced the 2009 version. It covers on-site and off-site destruction: contracts, records from collection to destruction, subcontracting, staff vetting, transport, premises and the security level for each type of material. It is voluntary, but it is the benchmark buyers use.
On this page
If you have asked a shredding firm about its credentials, you have probably heard “we’re BS EN 15713”. It is worth knowing what that means, because the standard was rewritten in 2023 and the details matter when you choose a contractor.
The standard in one paragraph
BS EN 15713:2023, Secure destruction of confidential and sensitive material. Code of practice, was published on 30 September 2023. BSI describes it as giving recommendations and requirements for the procedures, processes and performance monitoring used to manage and control the physical destruction of confidential and sensitive material. It covers destruction on site with mobile equipment, destruction off site at a facility, and storage of material where destruction equipment is kept. It does not cover destruction by erasure, such as overwriting or degaussing.
What changed from 2009
The 2023 edition is roughly twice the length of the 2009 version, and the trade body for the sector said its members would be audited against it from April 2024, with the 2009 edition withdrawn in the UK at the end of March 2024. The broad changes:
- More clauses: the standard grew from 12 to 21 clauses, adding supply chain, information security and business continuity.
- Security levels: material is now matched to a protection class and a security level from 1 to 7, drawing on the ISO/IEC 21964 series (the international successor to DIN 66399), instead of the older shred-size table.
- Categories of material: more types of material are covered, from paper to electronic media, each with its own destruction outcome.
- Closer alignment with data protection law, including UK GDPR expectations of processors.
What the clauses cover
The 2023 edition’s main clauses, in order:
| Area | What it deals with |
|---|---|
| Protection class and security level | Choosing how finely material must be destroyed |
| Destruction equipment | Who operates it and how changes to cutting units are recorded |
| Premises and holding sites | Security of destruction facilities and any place material is held |
| Controlled access | Who can enter secure areas |
| Contract | The written agreement with the client |
| Records | A record of the process from collection through to destruction |
| Subcontracting | When and how work can be passed on |
| Personnel | Non-disclosure, security clearance, training and control of drivers |
| Collection and transport | How material is moved |
| Storage at the facility | How long and how material waits before destruction |
| Business continuity and incidents | What happens when something goes wrong |
| Retention of records | How long the contractor keeps its own records |
| End product disposal | What happens to the shredded material |
| Supply chain and information security | Controls beyond the shredder itself |
Security levels, briefly
For paper, the security levels map to the familiar P-1 to P-7 scale, from strips up to 12 mm wide at P-1 to particles of 5 mm² or less at P-7. Most office paper with personal data is handled in the middle of the range; very sensitive material goes finer. The standard asks for the level to be chosen to suit the material, so ask your contractor which level you are getting and why. Our homepage on confidential waste disposal has the full table.
Drives and electronic media have their own scales. The NCSC refers to destroying media to particles of 6 mm or less where destruction is used. See hard drive destruction.
Is it a legal requirement?
No. It is a code of practice, not a law. UK GDPR requires you to use processors that provide “sufficient guarantees” of appropriate security (Article 28), and the ICO expects contracts and assurance such as destruction certificates (ICO). A contractor independently audited against BS EN 15713:2023 is one of the clearest ways to show you met that duty. Many public sector buyers require it in tenders.
Questions to ask a contractor
- Are you independently certified to BS EN 15713:2023, not just “working to” it? Who audits you?
- Which security level will my material be destroyed to?
- How are staff vetted and trained, including drivers?
- Do you subcontract any collection or destruction? To whom?
- What does your certificate of destruction show? Ask for a sample. Our guide to what a certificate should include has a checklist.
- How long is material held before destruction, and where?
A good contractor answers these in a few minutes. Hesitation is informative.
On site, off site, or either
The standard covers both on-site shredding and destruction at a facility, so neither route is automatically better. Choose on the basis of your material, any client requirements and cost. Most organisations start with a regular collection.
To find a contractor that works to the standard and covers your postcode, use the form below.
Where our information comes from
- BSI Knowledge: BS EN 15713:2023, Secure destruction of confidential and sensitive material, code of practice (read 2 November 2026)
- ICO: Accountability framework, destruction (read 2 November 2026)
- legislation.gov.uk: UK GDPR Article 28, processors (read 2 November 2026)
- NCSC: Secure sanitisation and disposal of storage media (read 2 November 2026)