Confidential waste disposal: getting it right under UK GDPR
Confidential waste disposal is a data protection question that happens to involve a lorry. Get the destruction right and the paper is just paper; get it wrong and the bin becomes a reportable breach.
Confidential waste: key facts
| What makes it confidential | It contains personal data, or commercially sensitive information, or both |
|---|---|
| The legal driver | UK GDPR requires appropriate security of personal data, including at destruction |
| You stay responsible | Using a shredding contractor does not transfer your duty as data controller |
| Waste paperwork too | A waste transfer note for every transfer, kept 2 years |
| What a shredder should give you | A certificate of destruction for each collection |
| Where the paper goes | Shredded paper is recycled; it does not need to be landfilled |
Two obligations, not one
Most businesses think about confidential waste as a shredding problem. It is actually two separate duties running at the same time, and they are enforced by different people.
The first is data protection. Personal data has to be processed securely, and destruction is processing. If a bag of customer records is tipped into a skip, that is an incident whether or not anybody reads them.
The second is waste law. Paper leaving your premises is controlled waste, so you need a waste transfer note describing it, kept for two years, and your carrier needs to be registered. Both duties apply to the same bag at the same time.
On site or off site
On-site shredding means a vehicle with a shredder comes to you and the material is destroyed before it leaves, usually with someone from your side able to watch. The chain of custody is short and easy to evidence, which is why regulated sectors tend to prefer it. It costs more and needs somewhere for the lorry to park.
Off-site shredding means sealed consoles or sacks are collected and destroyed at a facility. Cheaper per kilo and more practical for volume, at the cost of a longer chain of custody. If you go this way, the questions that matter are how the material is secured in transit, how long it may sit before destruction, and what evidence you get back.
Neither is automatically right. What matters is being able to show a decision was taken and why, because that is what a regulator asks.
What to ask a provider
- Are you registered as a waste carrier? The number begins CBDU and appears on the Environment Agency public register. Check it rather than take it on trust.
- Will you sign a written data processing agreement? You remain the data controller; they are processing on your behalf, and that relationship should be documented.
- Do we get a certificate of destruction for every collection, and what does it actually certify, the collection or the destruction?
- What happens between collection and destruction? Where is it stored, for how long, and who has access.
- Are your staff vetted and trained, and is any of this subcontracted?
- What shred size and standard do you work to? Strip cut, cross cut and particle sizes are not equivalent, and a provider should be able to state theirs.
What actually needs shredding
Less than most offices shred, and more than most realise. Anything with a name attached to anything else is personal data: HR files, payroll, application forms, customer records, delivery notes with addresses, visitor books, appointment lists, prescriptions, bank correspondence. Commercially sensitive material without personal data in it, such as pricing sheets and tender documents, is not a GDPR matter but is usually worth shredding anyway.
Ordinary office paper with no names on it is just paper and should go in the paper recycling, where it earns its keep instead of costing you shredding rates. Separating the two is the single easiest saving available on a confidential waste bill.
Where it ends up
Shredded paper is recycled into new paper and board; destruction and recycling are not alternatives. The UK recycled 84.1% of paper and cardboard packaging in 2024, with 80.3% provisionally in 2025. Ask your provider to confirm the material is recycled rather than incinerated, and keep that answer with your records.
Our directory lists companies handling confidential paper and general paper recycling by postcode, with phone numbers and websites where we have them.
Once destroyed, confidential paper rejoins the ordinary stream, and our guide to paper recycling covers what happens to it from there.
Frequently asked questions
Do I legally have to shred confidential waste?
UK GDPR requires personal data to be processed securely, and destruction counts as processing. It does not prescribe shredding specifically, but it does require a method appropriate to the risk, and for paper records that normally means shredding.
Does using a shredding company transfer my responsibility?
No. You remain the data controller. The shredding company processes on your behalf, which is why the relationship should be documented in a written agreement.
Is on-site or off-site shredding better?
On-site gives a short, easily evidenced chain of custody and costs more. Off-site is cheaper and handles volume better. What matters to a regulator is that you made a reasoned choice and can show it.
What is a certificate of destruction?
A document from your provider confirming material was destroyed. Ask exactly what it certifies, because some certify collection rather than destruction, and the two are not the same thing.
Does shredded paper get recycled?
Yes. Shredding and recycling are not alternatives; shredded paper goes on to be made into new paper and board. Ask your provider to confirm it is recycled rather than incinerated and keep the answer on file.