Secure Document Shredding and GDPR Compliance During a Corporate Clear-out

Direct answer

During a corporate clear-out, paper and storage media containing personal data must be kept secure until they are destroyed. Under UK GDPR, organisations should not keep personal data longer than needed and must protect it with appropriate security. First decide what you must retain and for how long, then destroy the rest using on-site or off-site shredding by a reputable provider, keep a chain of custody and obtain a certificate of destruction. This is general information, not legal advice; check ICO guidance and take advice on your own retention duties.

Contents

• Why clear-outs create data protection risk
• Where records hide
• What UK GDPR and the Data Protection Act 2018 expect
• People’s rights and your duties
• Decide what you must keep, and for how long
• Writing a simple retention schedule
• Sorting: keep, archive, destroy
• Box and label for collection
• Shredding options compared
• Questions to ask any provider
• Shred size and standards
• Hard drives, USB sticks and other media
• Chain of custody in the building
• Holding material safely before collection
• Using a contractor properly
• Due diligence checks
• Certificates and records of destruction
• Common certificate problems
• Staff rules during the clear-out
• Briefing staff in plain language
• Frequently asked questions

Why clear-outs create data protection risk

The paper you forgot you had.

Most organisations hold far more paper than they realise. Filing cabinets, desk drawers, archive rooms, off-site storage and the back of cupboards often contain HR files, customer records, contracts, invoices, medical notes, application forms and handwritten notes. Much of this contains personal data.

A clear-out brings all of that into motion. Boxes are carried out of locked rooms, left in corridors, loaded into vehicles and handed to third parties. Each step is a chance for a document to be lost, seen by the wrong person, or put into ordinary waste. A data breach does not need a hacker. A box left in a loading bay overnight is enough.

The aim of this guide is to help you plan a clear-out that is both efficient and secure. It cannot replace advice on your own legal duties, but it sets out the questions to ask and the practical steps that many organisations follow.

Where records hide

A quick search list.

Start the clear-out with a search list. Walk every room and note where paper and storage media may be found: filing cabinets, desk drawers, under-desk pedestals, meeting room cupboards, reception, print rooms, kitchens, store rooms, comms cupboards and any off-site storage.

Do not forget less obvious places. Old application forms may be in a manager’s drawer, signed contracts in a box under a desk, and passwords or customer details on notes stuck to monitors. Departments such as HR, finance, legal and sales usually hold the most sensitive material.

Also check what is held by third parties, such as storage companies, accountants and previous landlords. A clear-out of your own premises does not clear records held elsewhere, and you remain responsible for them.

What UK GDPR and the Data Protection Act 2018 expect

Principles, not a checklist.

UK GDPR, together with the Data Protection Act 2018, sets the rules for handling personal data in the UK. Two principles matter most in a clear-out. First, personal data should not be kept for longer than necessary for the purpose it was collected. Second, it must be kept secure, using appropriate technical and organisational measures, from collection to destruction.

The Information Commissioner’s Office (ICO) publishes guidance for organisations on these principles, on records management and on personal data breaches. It is the best place to start, and its pages are updated as the law and guidance change.

The rules apply to paper records that are part of a filing system, as well as digital ones. They also apply when you pass data to someone else to handle on your behalf. If a contractor shreds records for you, they are acting for you, and you remain responsible for making sure they do it securely.

People’s rights and your duties

The human side of records.

UK GDPR gives individuals rights over their personal data, including the right to access it and, in some cases, to ask for it to be erased. If your organisation is dealing with such a request, or a related complaint or dispute, do not destroy relevant records without advice.

You also have to be able to show that you comply, not just claim it. Written policies, retention schedules, logs of what was destroyed and contracts with providers all help to demonstrate this.

Smaller organisations are not exempt, though what is proportionate is different. The ICO offers guidance and tools aimed at small businesses, which are a practical place to start.

Decide what you must keep, and for how long

Retention comes before destruction.

Do not start shredding until you know what you are allowed, or required, to destroy. Different records have different retention periods, set by tax law, employment law, health and safety rules, sector regulators, contracts and your own policy. Some must be kept for years, others can go much sooner.

If you have a retention schedule, use it. If not, a clear-out is a good moment to create one, with advice from your solicitor, accountant, HR adviser or sector body as needed. Do not rely on a generic table you found online; the right period depends on the type of record and your own circumstances.

Think also about legal holds. If there is a dispute, investigation, claim or audit, records connected to it should not be destroyed. If in doubt, pause and ask for advice before anything leaves the building.

Writing a simple retention schedule

A starting point.

A retention schedule lists categories of record, how long each is kept, why and who is responsible. It need not be elaborate. A table with a few columns is enough to start, and can be refined with advice.

Typical categories include accounting records, payroll and HR files, customer and client files, contracts, health and safety records, insurance documents, property records and marketing data. For each category, note the reason for keeping it and the trigger for the retention period, such as the end of a contract or the end of employment.

Have the schedule reviewed by someone who knows the rules for your sector, because periods differ. Once agreed, apply it consistently, not only when the building is being emptied.

Sorting: keep, archive, destroy

Make the decision once.

Work through each area in turn and sort material into three groups: records you must or choose to keep, records that go to secure archive storage, and records that can be destroyed. Label each box clearly with its contents, the department, the date range and the decision.

For anything going to the shredder, note a rough description and quantity. You do not need to log every sheet, but you should be able to say what categories of document were destroyed and when. This is useful if a question arises later about whether a record existed or was destroyed under policy.

Ask staff who work with the records to help. They know which files matter and which are duplicates. Make it clear that nothing is to be thrown into ordinary waste or recycling bins during the clear-out, however harmless it looks.

Box and label for collection

Make the handover easy.

Use sturdy archive boxes that can be sealed, and number them. Record the box number, department and a broad description in your log. Avoid overfilling boxes, which split in transit and spill contents.

Separate material for archive storage from material for destruction, and use different coloured labels or tape to avoid mix-ups. A box that goes to the wrong place can mean either losing a record you needed or destroying one you should have kept.

Do not mix confidential paper with general rubbish, packaging or furniture. Where contents are mixed, treat the whole box as confidential. Remove metal fasteners only if the provider asks you to; many shredders handle staples and clips without trouble.

Shredding options compared

On-site, off-site or in-house.

There are three broad ways to destroy paper. In-house shredding uses your own machines. On-site shredding uses a contractor with a vehicle that shreds at your premises. Off-site shredding collects material in secure containers and destroys it at the contractor’s facility.

In-house shredding works for small volumes but becomes slow and unreliable in a clear-out. Machines jam, overheat and may produce large pieces. On-site shredding lets you watch the process, which some organisations prefer for sensitive material. Off-site shredding can handle large volumes efficiently, as long as the material is kept secure in transit.

Whichever you choose, ask about the provider’s security processes, staff vetting, vehicle security, and how long material is held before destruction. Ask whether they follow recognised standards, such as BS EN 15713 for the secure destruction of confidential material, and whether they can provide evidence.

Questions to ask any provider

Before you book.

• How and where is the material destroyed, and what standards do you follow?
• How are collection vehicles and containers secured?
• Are staff vetted, and who will have access to my material?
• How long is material held before destruction?
• What evidence do I get, and when?
• What happens to the shredded paper afterwards?
• What insurance do you hold, and can you show me?
• Can I witness the destruction if I want to?

Shred size and standards

Smaller is not always necessary, but know what you need.

Shredders cut paper in strips or in cross-cut or particle form. Security levels are often described under the DIN 66399 standard, which grades the size of the shredded particles. Higher levels mean smaller pieces and are suited to more sensitive material.

What you need depends on the sensitivity of the records. Ordinary business correspondence may not need the same treatment as medical records, financial data or material subject to special rules. Ask your data protection lead or adviser what level is appropriate, and tell the provider.

Paper is only one format. Hard drives, USB sticks, CDs, backup tapes and phones need different treatment. Our guide on WEEE regulations and electronics recycling covers the waste side of old electronics, and specialist data destruction is a separate service.

Hard drives, USB sticks and other media

Not covered by a paper shredder.

Digital storage needs its own plan. Deleting files or reformatting a drive does not always make data unrecoverable. Specialist wiping or physical destruction is usually the safer route, with a certificate to show what was done.

Keep a list of devices with serial numbers and decide whether each will be wiped for reuse or destroyed. Reused devices need a verified wipe, while damaged devices, backup tapes and old media are often destroyed physically.

Do not hand devices over with the furniture or general waste. Pass them to IT or a specialist provider, and keep records of what went where.

Chain of custody in the building

From desk to destruction.

Chain of custody means being able to say where the material was at each stage, who had access and when it changed hands. For a clear-out, that can be as simple as locked containers, a named person responsible for keys, a record of collection and a signed handover.

Keep confidential material in locked bins or sealed boxes, not in open corridors. Store them in a locked room until collection, and limit who has keys. Do not leave boxes in vehicles overnight unless the vehicle is secured and the provider agrees to it.

If a carrier or other contractor collects the boxes, record the date, time, quantity, vehicle and the name of the person collecting. Ask for a receipt. This is the paper trail that protects you if a box is later reported missing.

Holding material safely before collection

The gap is the risk.

The time between boxes being packed and being collected is when many losses happen. Pick a locked room, such as a store or an office with a controlled door, and keep a key log.

If the building has shared access, ask building management about keeping boxes in a secure area, and make sure cleaners and contractors do not have unsupervised access to the room.

Reduce the gap. Book the collection for close to the packing date, and schedule it so that boxes do not sit over a weekend or holiday unless the room is properly secured.

Using a contractor properly

Written terms matter.

If an outside company is destroying records on your behalf, UK GDPR expects a written contract that sets out how they will handle the data, what security they will apply and what happens at the end. Your data protection lead or solicitor can advise on the right terms.

Check that the provider is who they say they are. Ask for company details, evidence of insurance, relevant accreditations and how they will evidence destruction. Our guide to public liability insurance for clearance crews explains what that cover does and does not include.

Carriers who collect waste should be registered with the Environment Agency, and you can check this on GOV.UK. See our guide to waste duty of care for the principles, which apply to businesses too. A shredding provider and a general clearance carrier may be different businesses, so be clear who is doing what.

Due diligence checks

Proportionate, not paranoid.

Ask for the provider’s company name and registered address, and check them on Companies House. Ask for their waste carrier registration if they collect waste, and check it on the Environment Agency’s public register through GOV.UK.

Look at what the provider says about its processes and ask for it in writing. Vague promises about security are not enough where sensitive records are involved.

References from other organisations of a similar size and sector can be useful. Be cautious of providers who cannot explain where material is destroyed or who refuse to put the terms in writing.

Certificates and records of destruction

Keep the evidence.

A certificate of destruction is a document from the provider confirming that the material was destroyed, on a specific date, by a specific method. It normally includes the company name, your name, the date, a description or quantity of the material and a reference.

Keep certificates along with your collection receipts, contracts and your own sorting log. Together they show that you handled the material responsibly. Keep them for as long as your policy or advice suggests, remembering that these are records too.

Check the certificate against what you handed over. If it states a weight or number of containers that does not match your own record, ask for an explanation. Our guides on waste transfer notes and invoices and records explain the other paperwork a clear-out may produce.

Common certificate problems

What to look for.

Check that the certificate has a date, the provider’s details, your organisation’s name, a clear description of the material and a reference that matches your collection record. Certificates that are undated, unsigned or generic are of limited value.

Be wary of a certificate issued before the material was actually destroyed, or one that says nothing about method. If you were promised on-site destruction, the certificate should say so.

Store certificates in a place you can find later, such as a shared compliance folder, and keep them as long as your policy requires. They are only useful if you can produce them when asked.

Staff rules during the clear-out

Short, clear and enforced.

• Nothing confidential goes in ordinary bins, recycling bags or skips.
• Sealed boxes and locked bins are never left unattended in corridors or reception.
• Clean-desk checks before the crew arrives, including drawers, pedestals and under-desk storage.
• Personal data on whiteboards, sticky notes and wall planners is removed and shredded.
• Devices and storage media are handed to IT, not thrown away.
• Anyone who finds a lost or misplaced document reports it straight away.

Briefing staff in plain language

Keep it practical.

Hold a short briefing before the clear-out begins. Explain why it matters, what to do and what not to do, and who to ask. Use plain language and examples, such as: the box of old application forms goes in the locked store, not the skip.

Make it easy to do the right thing. Provide locked bins, labels, boxes and a named contact for questions. People take shortcuts when the right route is slow or unclear.

Remind people that the clear-out also covers personal items. Staff files, notes and printouts may include other people’s data, and they should not be taken home or left lying around.