GDPR Document Disposal Guide

Secure document destruction · UK business guide

When a business no longer needs personal information, disposing of it securely is part of protecting the people behind the records. But does UK GDPR actually require a particular shredder, a Certificate of Destruction or an outside contractor? The answer is more nuanced than many guides suggest.

At a glance: UK GDPR requires appropriate security and limits how long personal data should be kept. It does not prescribe one shredding grade or a universal destruction deadline. Choose a method proportionate to the risks, protect records awaiting collection and retain sensible evidence of what happened.

What does UK GDPR require when disposing of documents?

Two principles matter particularly when confidential paperwork reaches the end of its useful life:

Storage limitation (Article 5): organisations should not keep identifiable personal data longer than necessary for the purposes for which it is held, subject to other applicable retention obligations.
Integrity and confidentiality (Articles 5 and 32): organisations must use security measures appropriate to the risk, including during storage, transfer and disposal.

That means reviewing what should be retained before arranging destruction. Some records must be kept for tax, contractual, employment or sector-specific reasons; others may need to be preserved because of an investigation or dispute. The ICO does not set one retention period for every type of record.

Read the ICO’s storage limitation guidance for the underlying principles.

Does GDPR require cross-cut or micro-cut shredding?

No specific paper shredder grade is universally mandated by UK GDPR. The ICO identifies cross-cut and micro-cut shredding as examples of secure disposal methods. The right approach depends on the sensitivity of the information, the volume of material and the risk of reconstruction or unauthorised access.

For smaller volumes

In-house shredding

Can be appropriate where staff have suitable equipment, follow a clear process and protect material before destruction.

Consider: staff time, machine capacity, secure storage and whether your organisation needs a disposal log.

For regular or bulk disposal

Professional shredding

Can reduce the operational burden and provide collection and destruction documentation to support your records.

Consider: collection controls, service scope, documentation and how the provider handles material before destruction.

Neither option is automatically compliant just because of the equipment used. A robust disposal process includes deciding what may be destroyed, controlling access and making sure the destruction actually takes place.

How to build a secure document disposal process

Check retention requirements. Identify records due for review and confirm that no legal, regulatory or operational reason requires continued retention.
Separate confidential waste. Keep personal data out of ordinary paper recycling until it has been securely destroyed.
Protect material awaiting destruction. Use suitable sacks, containers or restricted storage areas; limit access to authorised people.
Choose an appropriate destruction method. Consider the sensitivity and volume of the material and whether in-house or professional shredding is suitable.
Document the disposal. Keep a proportionate record of what was sent for destruction, when it was transferred and when destruction was confirmed.
Review the process. Update responsibilities and retention arrangements when your business or information risks change.

Are Certificates of Destruction legally required?

A Certificate of Destruction is valuable evidence, particularly where an external provider handles confidential material. However, UK GDPR does not impose a blanket requirement for every organisation to obtain a certificate for every disposal event. The important obligation is to implement appropriate measures and be able to demonstrate accountability.

For Secure Shred collections, a Waste Transfer Note records the transfer of waste, while a Certificate of Destruction is issued after the material has been destroyed. These documents serve different purposes: a transfer note is not itself proof that destruction has taken place.

Practical tip: Keep the collection and destruction paperwork together. Where relevant, match it to your own internal disposal authorisation or records schedule.

What about outsourced shredding and Article 28 contracts?

When a supplier processes personal data on behalf of a controller, Article 28 generally requires a written contract containing specified terms. But the legal roles must be assessed in the actual arrangement; not every waste transaction has an identical controller–processor relationship.

If a processor relationship applies, the controller should assess the provider’s safeguards and ensure the appropriate contractual terms are in place. A destruction certificate is useful evidence, but it does not replace an Article 28 agreement where one is required.

See the ICO’s guidance on controller–processor contracts.

What about hard drives, laptops and digital records?

Digital information requires a different approach. Deleting files or performing a quick format may leave recoverable data on storage media. Suitable sanitisation or physical destruction depends on the device, whether it will be reused and the risk associated with the information.

Traditional hard drives and solid-state drives behave differently, so a method that works for one device may not be appropriate for another. Organisations should also consider backups, cloud copies and records stored elsewhere.

For a closer comparison, see our guide to hard drive wiping versus physical destruction.

How Secure Shred supports confidential document disposal

Secure Shred provides document shredding services for households and organisations across Cardiff and surrounding South Wales areas, including one-off collections, shredding sacks, scheduled services and larger clear-outs.

Customers receive a Waste Transfer Note at transfer and a Certificate of Destruction after processing. Secure Shred also offers destruction of eligible IT equipment alongside any document shredding service, helping customers address paper records and unwanted devices together.

Our standard collection service involves taking material away for destruction; on-site shredding is a separate optional service, subject to suitability and availability. If you are unsure which option suits your volume, contact us before booking.

Secure Shred · South Wales

Ready to dispose of confidential documents?

Explore our one-off collection options or ask us about regular shredding, archive clear-outs and eligible IT equipment.

View one-off collection options

Frequently asked questions

Is shredding compulsory under UK GDPR?

UK GDPR requires appropriate security, but it does not mandate shredding in every situation. The method must be suitable for the information and the risks involved.

Can confidential documents go in ordinary recycling?

Readable confidential documents should not be put into ordinary recycling without suitable safeguards. Secure destruction before recycling helps prevent unauthorised access.

Do I need a Certificate of Destruction?

Not in every case as a universal statutory requirement. Certificates are useful evidence when a professional provider carries out destruction and may be required by your own policies or contractual commitments.

How quickly must records be destroyed?

There is no universal one- or two-week UK GDPR deadline. Organisations should review retention needs, avoid unnecessary storage and dispose of records securely when they are no longer required.

GDPR Document Disposal: A UK Business Guide