Confidential waste: what it is and how to dispose of it safely
Confidential waste is any paper, device or item that holds personal or sensitive information and is no longer needed. Data protection law requires a business to destroy it securely. The usual way is a shredding service that works to the BS EN 15713 standard and gives a certificate of destruction.
Confidential waste: key facts
| What it covers | Paper, hard drives, phones, ID cards, uniforms and anything else that holds private information |
|---|---|
| The law | UK GDPR and the Data Protection Act 2018 require personal data to be kept secure until it is destroyed |
| The standard | BS EN 15713, for the secure destruction of confidential material |
| Proof | A certificate of destruction for every collection |
| Largest fine | 17.5 million pounds or 4% of worldwide turnover, whichever is higher |
What counts as confidential waste?
- Customer and staff records, payslips and CVs
- Invoices, bank statements and contracts
- Medical and legal files
- Computers, hard drives, phones and memory sticks
- ID badges, access cards and branded uniforms
If it names a person, or would harm the business in the wrong hands, treat it as confidential.
How is confidential waste destroyed?
| Method | How it works | Best for |
|---|---|---|
| Shredding on site | A lorry shreds the paper outside your premises while you watch | The most sensitive material |
| Shredding off site | Locked bins or sacks are collected and shredded at a secure depot | Regular office volumes, at lower cost |
| One off clearance | A single collection of archive boxes | Office moves and old files |
| Media destruction | Hard drives and devices are wiped, crushed or shredded | Old computer equipment |
What to ask a shredding company
- Do you work to BS EN 15713, and are your staff security vetted?
- Is the waste locked up from collection to destruction?
- Will I get a certificate of destruction each time?
- Are you a registered waste carrier?
- Is the shredded paper recycled?
Shredded paper is recycled, usually into tissue products, so secure destruction and recycling go together. Read more in our guide to paper recycling.
Confidential waste collection near me
Frequently asked questions
What is confidential waste?
Any paper, device or other item that holds personal or commercially sensitive information and is no longer needed, such as customer records, payslips and old hard drives.
Is confidential waste a legal requirement?
Secure disposal is. UK data protection law requires a business to keep personal data safe until it is destroyed, whatever form it is in.
What is a certificate of destruction?
A document from the shredding company that confirms what was destroyed, when and how. Keep it as evidence that you met your duty.
Is shredded paper recycled?
Yes. After shredding, the paper is baled and sent to a paper mill, where it is usually made into tissue products.
How long should documents be kept before shredding?
Only as long as you need them. Tax records are usually kept for six years. Personal data should not be held longer than its purpose requires.