Since GDPR came into force in 2018, businesses across the UK have faced strict obligations around how personal data is handled and disposed of. Yet document disposal remains one of the most commonly overlooked areas of data protection compliance — and one of the most costly when it goes wrong.
What Does GDPR Say About Document Disposal?
GDPR (and the UK Data Protection Act 2018) requires that personal data is processed — which includes disposal — in a manner that ensures appropriate security. Article 5 of the UK GDPR specifically requires that personal data is processed with 'appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.' Throwing documents containing personal data in the general waste bin, or shredding them in a basic office shredder, does not meet this standard.
What Counts as Personal Data in Documents?
Any document that contains information identifying a living individual falls under GDPR. In practice, this includes customer invoices and order records, employee records and payroll documents, contracts containing names and contact details, medical or health records, financial statements, application forms, and correspondence containing names and addresses.
Why Isn't an Office Shredder Enough?
Basic office strip shredders produce long strips of paper that can be reassembled with patience and the right tools. Even cross-cut shredders don't always produce fine enough particles to prevent reconstruction. Industry-standard secure destruction involves cross-cut shredding to a particle size that meets the DIN 66399 security standard — this is what approved shredding facilities use. Additionally, an office shredder leaves you with no documentation trail — no Certificate of Destruction — which means you can't prove compliance if challenged.
What Is a Certificate of Destruction?
A Certificate of Destruction is a formal document issued after your materials have been securely shredded. It records what was destroyed, when, how, and by whom — giving you an auditable proof of compliance. If you're ever investigated by the ICO following a data breach or complaint, this certificate demonstrates that you took your obligations seriously and disposed of documents correctly.
How Our Service Works
We supply tracked shredding bags secured with a uniquely numbered cable tie. The numbered tie means every bag has a traceable identity from the moment it leaves your premises to the moment it's destroyed. You fill the bag with your confidential documents, call us when it's full, and we collect and send it for professional destruction. You receive a Certificate of Destruction when the job is complete.
Who Should Be Using a Shredding Service?
Any business that handles personal data and generates paper documents should have a secure destruction process in place. This is particularly important for solicitors and legal firms, accountants and bookkeepers, GP surgeries and healthcare providers, estate agents, HR departments, schools and educational institutions, and financial services businesses.
Call us on 01424 732643 to discuss your confidential shredding requirements. We serve businesses across East Sussex and can get a collection arrangement in place quickly.
