Paperwork Disposal: The UK Guide to Doing It Safely

 

Most paperwork disposal goes wrong the same quiet way. Someone clears a cupboard, decides the files are too old to matter, and puts the lot in the recycling bin behind the building. Months later a client asks how their bank details ended up somewhere they should not be.

Under UK GDPR and the Data Protection Act 2018, secure document disposal is a legal duty rather than housekeeping. Here is what that means in practice.

GDPR Document Disposal: The Legal Position

The storage limitation principle says personal data should not be kept longer than necessary. So once you no longer need a document, holding it is a compliance problem and binning it carelessly is a bigger one. The Information Commissioner's Office treats insecure disposal as a personal data breach in the same way it treats a hacked database.

• Personal data in an ordinary waste or recycling bin counts as an unsecured disposal.
• Reportable breaches must reach the ICO within 72 hours of you becoming aware.
• GDPR document disposal duties apply to sole traders and small firms, not only to large organisations.
• Fines are the visible cost. Telling clients their records were found in a skip is the other one.

Confidential Waste Disposal: What Counts As Sensitive Paperwork 

If a document names a person, or reveals something a competitor or fraudster could use, it belongs in confidential waste disposal rather than general recycling.

• Client records, contracts, quotes and correspondence
• HR files, CVs, references and right to work copies
• Payroll, P60s, P45s, expenses and pension paperwork
• Invoices, purchase orders, bank statements and receipts
• Medical, dental and care records, including appointment lists
• Legal, insurance and property documents
• Pricing sheets, strategy papers and supplier terms

Printed emails, diary pages and delivery labels count too. Fraud rarely needs a full file. A name and address on a delivery note is a starting point.

How Long To Keep Paperwork UK : Retention Periods

Destroying records too early causes as many problems as hoarding them. General guidance runs as follows, and your accountant should confirm what applies to you.

• Corporation Tax and VAT records: six years
• Self-assessment records: five years after the 31 January deadline for that tax year
• PAYE and payroll: three years after the end of the tax year
• Working time records: two years
• Right to work checks: two years after employment ends
• Personal bank and card statements: typically twelve to twenty-four months

Date every box when it goes into storage, and review once a year after year end so disposal runs on a schedule.

Why Bins And Office Shredders Fails Secure Document Disposal

• Recycling is sorted and handled by people you have never met, and paper stays readable.
• Strip-cut office shredders produce ribbons that can be reassembled.
• Small machines jam on staples and volume, so the awkward material gets binned intact.
• You end up with no evidence. "We shredded it ourselves, probably in March" is not an answer for the ICO.

How To Dispose Of Old Documents Securely

There is no single right method. Volume, sensitivity and frequency decide it.

• On-site mobile shredding destroys everything at your premises so your team can witness it. Best for highly sensitive files.
• Off-site shredding collects material in locked containers for destruction at a secure facility. Usually the cheapest route for bulk.
• Scheduled collections put locked consoles in the office, emptied daily, weekly or monthly.
• One off shredding suits clear-outs, archive purges and relocations, with no contract and pricing per sack or box.
• Drive-thru shredding lets you watch documents destroyed while you wait. Total Shred runs this from Stanmore.
• Residential collections cover home paperwork disposal, house moves and probate clear-outs.

Document Shredding Services:What a Compliant Process Looks Like

• Segregate at the desk into a locked console, not an open bin.
• Keep the container sealed until it reaches the shredder.
• Destroy to BS EN 15713, the standard for secure destruction of confidential material.
• Take a Certificate of Destruction for every job and file it with your compliance records.
• Recycle the output, so secure disposal costs nothing environmentally.

Total Shred works to BS EN 15713, ISO 9001 and ISO 14001, issues a Certificate of Destruction with every job and recycles 100 percent of the paper it destroys.

Paperwork Disposal Cost, and What To Ask A Provider

Pricing follows volume, frequency and method. One-off work is priced per sack or box, scheduled services per collection or console, and bulk contracts reduce the per-unit price. On-site mobile shredding costs more than off-site collection because the vehicle comes to you.

Before you book, ask four things:

• Do you destroy to BS EN 15713, and what particle size does that produce?
• Do I get a Certificate of Destruction for every collection?
• Are staff vetted and vehicles tracked?
• Do you handle hard drives, IT equipment and branded products as well as paper?

That last one matters. The same cupboard usually turns up old laptops, backup drives and ID cards, and one certified provider means one audit trail instead of three.

Frequently asked questions

What is paperwork disposal?

Getting rid of documents you no longer need in a way that stops the information being recovered. Where personal data is involved, UK GDPR and the Data Protection Act 2018 require secure, certified destruction rather than a recycling bin.

Is it illegal to put confidential paperwork in the bin?

Placing documents containing personal data in ordinary waste can constitute a personal data breach under UK GDPR, and the ICO can act on it. You remain responsible for the data until it is securely destroyed.

How long should I keep paperwork before shredding it?

As a guide, Corporation Tax and VAT records six years, self-assessment five years after the 31 January deadline, PAYE three years after the tax year ends, and personal bank statements twelve to twenty-four months. Some sectors require longer, so confirm with your accountant.

Can I just use my office shredder?

For the odd sheet, yes. For anything regular it falls short: strip-cut output can be reassembled, small machines jam, and you get no certificate proving destruction happened.

What is a Certificate of Destruction?

A document confirming what was destroyed, when and to what standard. It is the proof you show auditors, insurers or the ICO. Total Shred issues one for every job, including one off shredding and drive-thru visits.

Is on-site or off-site shredding better?

On-site destroys material at your premises so you can watch it, which suits highly sensitive files. Off-site collection is normally more cost-effective for bulk volumes. Both end with a Certificate of Destruction.

Can you dispose of hard drives and IT equipment too?

Yes. Hard drives, laptops, backup tapes, ID cards and branded products all hold recoverable data, and Total Shred destroys these alongside documents under the same certified process.

Book secure paperwork disposal

One sack from a house clearance or a year of archive boxes from an office move, the process is the same: locked collection, certified destruction to BS EN 15713, a Certificate of Destruction, and 100 percent recycling. Searching shredding services near me or document shredding services returns plenty of options. Total Shred covers the whole UK, on-site, off-site and drive-thru, with no contract needed for one-off work. Get in touch for a quote based on your volume.