How do you dispose of confidential waste?

Every office produces confidential waste: payslips, client letters, CVs, bank statements, medical notes, the printout someone forgot to collect. Getting rid of it safely is not complicated, but it does need a routine that works on a busy Tuesday as well as on the day someone thinks about data protection.

The legal starting point

UK GDPR requires organisations to keep personal data secure, using “appropriate technical and organisational measures” (Article 32). That duty does not end when paper goes in a bin. If a shredding firm handles your waste, it is processing personal data on your behalf, and you need a written contract with processor terms (Article 28).

The ICO’s accountability framework spells out what it expects in practice. Records with personal data go into locked waste bins. Disposal is by cross-shredding or incineration, in-house or by a third party. Contracts cover disposal of personal data, and providers give assurance such as certificates of destruction. You keep a log of confidential waste sent for destruction.

A simple routine that works

1. Put locked containers where paper is created

A lockable console or bin with a slot, next to the people who print and handle personal data, is the single most useful step. If the secure option is closer than the desk bin, people use it. See bins, consoles and sacks for which suits which room.

2. Tell staff one simple rule

“If it has a name, a number or a client on it, it goes in the console.” Do not ask staff to judge what is confidential enough. Sorting wastes time and leads to mistakes.

3. Have it collected and destroyed on a schedule

For most organisations a regular confidential waste collection every two or four weeks is the right answer. The contractor empties or swaps the containers, takes the contents for shredding (or shreds outside, if you choose on-site shredding) and sends a certificate.

4. Check and file the certificate

Someone should check each certificate matches the collection, then file it. Our guide to what a certificate of destruction should include has a short checklist.

5. Clear backlogs separately

Old archive boxes past their retention date are better handled in a single one-off purge than fed slowly into consoles.

Shredding in-house: when it is enough

A small office with a few sheets a day can shred in-house, as long as the shredder cuts small enough. Strip-cut shredders produce long strips that can be reassembled; the ICO refers to cross-shredding, and a cross-cut or micro-cut model is the sensible minimum for personal data. Under the DIN 66399 scale, P-4 particles are no larger than 160 mm²; many office models are rated P-4 or P-5.

The weaknesses of desk shredders are practical. They jam, they overheat, they take time, and paper waits beside them in a “to shred” pile that is itself a risk. Once that pile appears, a collection service is usually cheaper than the staff time.

What not to do

What can go wrong

In December 2019 the ICO issued its first monetary penalty under the Data Protection Act 2018 to a London pharmacy, after unlocked crates of sensitive personal information were found in publicly accessible premises. The fine was later reduced to £92,000 on appeal, and in December 2024 the Court of Appeal dismissed the pharmacy’s further appeal (ICO). The failure was not the shredding. It was the waiting.

Drives and devices

Hard drives, SSDs, phones and USB sticks hold the same data as paper and need their own route. Keep them in a separate locked container, list their serial numbers, and have them destroyed with serials on the certificate.

Choosing a contractor

Ask whether the firm works to BS EN 15713:2023, the current code of practice; how staff are vetted; what security level it shreds to; for its waste carrier registration; and for a sample certificate. Our homepage on confidential waste disposal covers the rules in more detail, and the cost estimator gives typical prices.

If you would like a contractor that covers your postcode, fill in the form below.