Your legal obligation for secure document disposal.
UK GDPR places a clear obligation on every business that processes personal data — including the obligation to dispose of physical documents securely when they are no longer needed. Recycling is not enough. General waste is not enough. Here is what the law requires and how to meet it.
UK GDPR and physical document disposal.
Most discussions of UK GDPR focus on digital data — databases, email systems, cloud storage. But the legislation applies equally to personal data held in physical form. Every client letter, employee payslip, patient record, customer application form and financial document that contains personal data falls under the same data protection framework as digital records.
UK GDPR Article 5(1)(e) sets out the storage limitation principle — personal data must not be retained for longer than necessary for the purpose for which it was collected. When a document has met its retention period, the personal data within it must be disposed of. Article 5(1)(f) requires that this disposal is done securely, in a way that protects the integrity and confidentiality of the data. And Article 5(2) requires that you can demonstrate compliance — which means documented evidence of secure disposal.
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.UK GDPR Article 5(1)(f)
Placing documents in a recycling bin, a general waste bin, or even a confidential waste bag that is not securely destroyed does not meet this standard. The ICO is clear: secure disposal means destruction that prevents recovery of the personal data.
Personal data must not be kept for longer than necessary. When the retention period for a document has passed, the personal data within it must be disposed of. Keeping records indefinitely — even in a locked filing cabinet — is a breach of this principle.
Personal data must be handled securely at every stage of its lifecycle, including at disposal. Putting documents in a recycling bag or general waste bin is not secure handling. The standard requires that personal data is destroyed in a way that prevents recovery.
You must be able to demonstrate that you have complied with UK GDPR. For document disposal, this means having documented evidence of secure destruction — a certificate of destruction from a certified provider is the standard form of this evidence.
Health data, biometric data, criminal conviction data and other special categories require a higher standard of protection. Medical records, DBS certificates, occupational health records and similar documents require the most secure disposal method.
What counts as secure disposal under GDPR.
Not all forms of document disposal meet the UK GDPR security requirement. The distinction matters — and the ICO has investigated organisations for getting it wrong.
The ICO has acted against insecure document disposal.
The ICO has investigated and taken action against organisations of all sizes for data breaches arising from insecure physical document disposal. These are illustrative examples of the type of cases the ICO handles — not an exhaustive list.
NHS organisations have faced ICO investigation following incidents where patient records were found in public spaces after being incorrectly disposed of — in some cases placed in general waste rather than secure destruction.
Financial organisations have faced enforcement action after client documents containing personal and financial data were found in accessible recycling bags rather than being securely shredded.
Organisations unable to demonstrate that personal data was securely disposed of — because they had no documented procedure and no certificates of destruction — face ICO scrutiny even where no specific incident occurred.
Documents containing personal data that must be shredded.
Any document that identifies or could identify a living individual is personal data under UK GDPR and must be disposed of securely at end of retention. This includes:
Five steps from collection to compliance.
Our service is designed specifically to meet the UK GDPR obligation for secure physical document disposal — with a certificate of destruction at the end that closes the loop on your accountability requirement.
GDPR document disposal FAQs
Meet your GDPR disposal obligation from £19/month.
Certified shredding with automatic certificate of destruction across Dorset, Hampshire and Wiltshire. Same-day quote confirmed.
89 Commercial Road, Bournemouth, England, BH2 5RR
Office@Clearcutconfidentialwaste.co.uk
01202 022409
© 2026 Clearcut Confidential Waste