The short answer
A certificate of destruction should name your organisation and the collection address, give the date of collection and of destruction, say what was destroyed and how much (containers, sacks, weight or drive serial numbers), state the method and security level, and carry a unique reference that ties back to the collection record. The ICO suggests someone checks each certificate against what was actually sent and files it.
On this page
Every time a shredding contractor takes confidential paper or drives away, you hand over something you are legally responsible for. The certificate of destruction is the piece of paper (or PDF) that closes that loop. It is what you show an auditor, a client or the Information Commissioner’s Office if anyone asks what happened to those files.
Why the certificate matters
Under UK GDPR you stay responsible for personal data until it is destroyed, even when a contractor does the destroying. The ICO’s accountability framework expects contracts with destruction firms to cover disposal of personal data, and expects providers to give “appropriate assurance” that it was destroyed, naming audit checks and destruction certificates as examples.
The ICO’s records management toolkit goes a step further. It suggests giving someone the job of checking that destruction certificates match what you sent, and keeping a log of all confidential waste and equipment sent for destruction. A certificate that nobody reads is only half the job.
The code of practice for the industry, BS EN 15713:2023, defines a certificate of destruction and has a clause on keeping a record of the process from collection through to destruction. A contractor working to it should produce certificates as a matter of routine.
What a good certificate shows
| Field | Why it matters |
|---|---|
| Your organisation and collection address | Ties the certificate to your site, not just your account |
| Collection date | Matches your own visit log |
| Destruction date | Shows material was not left waiting for weeks |
| What was destroyed | Number of consoles, bins or sacks, a weight, or a list of items |
| Container or seal references | Lets you match each sack or bin to the collection |
| Method | Shredded on site, shredded at a facility, or another method |
| Security level or particle size | Shows it was destroyed to the level agreed |
| Unique certificate reference | Lets you and the contractor find the record later |
| Contractor name and contact | Who is answerable for it |
Extra fields for drives and devices
For hard drives, SSDs, phones and tapes, the certificate should list the serial number of every item destroyed. The NCSC guidance on storage media refers to destroying media to particles of 6 mm or less and checking the particle size afterwards, so a good certificate also states the particle size or security level reached. Compare the list of serials with your own inventory line by line. Our hard drive destruction page explains the process.
How to check a certificate
A two-minute check each time is enough for most organisations:
- Does the date match? Compare it with the day the collection happened.
- Does the quantity match? If three consoles were emptied, the certificate should not say one.
- Do the references match? Sack tie numbers or container IDs should agree with any collection note you were given.
- Is the method what you paid for? On-site shredding should say so; so should the security level.
- For drives, do all the serials appear? Any missing serial needs an answer before you file it.
If something does not match, raise it with the contractor straight away, in writing. A small discrepancy is usually a clerical slip; an unexplained one is worth taking seriously.
Paper, PDF or portal?
Most contractors now issue certificates by email or through an online portal. That is fine. The ICO toolkit mentions keeping electronic confirmations in a dedicated folder or inbox. What matters is that you can find them quickly. A simple folder per year, with each certificate named by date, works for most offices and practices.
How long to keep certificates
There is no single legal period. Think about why you would need it: to answer a complaint, an audit, a client’s due diligence or a question from the ICO about a breach. Many organisations keep certificates for at least as long as they would have kept the records themselves, and set the period in their retention schedule. Our guide on how long to keep documents covers common record types.
Regular service or one-off job
On a regular collection you should receive a certificate after every visit, not one a year. For a one-off purge you get a single certificate for the job; attach it to your record of what was cleared and who approved it.
What a certificate does not prove
A certificate is a statement by the contractor. It is only as good as the process behind it. That is why it is worth asking, before you sign a contract, whether the firm works to BS EN 15713:2023, how staff are vetted, and whether you can see or audit the process. The certificate is the last link in a chain of custody, not a replacement for one.
Getting it right from the start
If your current contractor’s certificates are vague, ask for a better format or look elsewhere. When you ask for confidential waste prices, say you need certificates that list quantities, references and, for drives, serial numbers. Any firm that works to the standard will not find that unusual.
If you need a contractor that issues proper certificates, use the form below and we will find one that covers your postcode.
Where our information comes from
- ICO: Accountability framework, destruction (read 2 November 2026)
- ICO: Records management toolkit, disposal and deletion (read 2 November 2026)
- BSI: BS EN 15713:2023, Secure destruction of confidential and sensitive material, code of practice (read 2 November 2026)
- NCSC: Secure sanitisation and disposal of storage media (read 2 November 2026)